feat: add gear provenance models and browser fetcher

docs/PROJECT_AUDIT_2026-09-20.md

@@ -97,9 +97,13 @@ has semantic light/dark tokens, system/manual theme selection, forced-colors
 rules, nonce-based JSON-LD CSP, noindex/no-store handling for admin/error
 surfaces, responsive pagination and reduced-motion styles.
 
-Automated structural checks pass, but visual acceptance is not equivalent to
-`astro check`. B25, D05/D07 and A06 remain open for desktop/mobile light/dark,
-forced-colors, focus order, long data, empty/error states and screenshots.
+Automated structural and browser checks pass, but visual acceptance is not
+equivalent to `astro check`. The local visual matrix now covers 13 routes × 4
+viewports × 3 theme modes (156 combinations) without document overflow, with
+matching SSR theme, `main` and `h1`; accessibility E2E covers axe 9/9,
+keyboard/focus, print and forced-colors. B25, D05/D07 and A06 remain open only
+for retained reference screenshots and manual review of long data,
+empty/error states, shadows and gradients.
 
 ## Security and operations
 
@@ -133,17 +137,21 @@ completed for 226 alternatives; 253 fish assets are published, 252 with
 1024×1024 WebP and one explicit low-resolution fallback. Offline media audit
 reports no checksum/dimension/MIME/provenance/orphan problems.
 
-This does not close B25: browser checks for broken images, responsive overflow,
-light/dark presentation and source links are still required. It also does not
-grant new source permissions; Q01 remains the source-rights gate.
+Browser checks now cover broken images, responsive overflow, light/dark
+presentation and source links on the media/admin paths; the visual matrix also
+confirms route-level overflow and SSR theme consistency. This does not close
+B25 because retained reference screenshots and manual visual review are still
+required. It also does not grant new source permissions; Q01 remains the
+source-rights gate.
 
 ## Prioritized action plan reflected in ROADMAP
 
 1. **Release blockers:** repeat the clean production Compose/bootstrap gate;
    verify readiness, migration current, proxy routing, backup/restore and
    production secret/preflight checks (A07 and open-alpha gate).
-2. **Browser gates:** complete B25 media, A06 admin/accessibility and D07 full
-   visual matrix when a Chromium/browser backend is available.
+2. **Browser gates:** retain reference screenshots and finish the remaining
+   manual visual review for B25, A06 and D07; the Chromium matrix and
+   accessibility regression gates are already green locally.
 3. **Waterbody data:** process the remaining 18 detail snapshots under the
    shared cooldown, then complete W03–W08 without assigning unreviewed media
    roles.