feat(uicheck): Playwright interaction loop (forge uicheck interact)

[CodeWithJuber]

What & why

Implements the ROADMAP "Next" item "Playwright loop". Where forge uicheck visual fingerprints what the browser paints, forge uicheck interact <file-or-url> checks what it does — driven headless under prefers-reduced-motion:

• console-clean — no console errors on load
• keyboard-reachable — Tab lands on an interactive control
• focus-visible — the focused control shows a visible focus ring (WCAG 2.4.7)
• reduced-motion — nothing animates when reduced motion is requested

The verdict is expressed in the ledger's own evidence vocabulary and recorded through the cross-family-gated behavioral oracle (ledger.js, w=0.3), so it's advisory by default — a lone interaction run can never move a claim on its own (overview §4 honesty register), the same guard-over-prose discipline as the visual gate:

• --record appends the verdict as evidence on the project fingerprint claim
• --enforce (or FORGE_ENFORCE=1) turns a fail into a non-zero exit

Reuses the visual gate's Playwright resolver (resolvePlaywright) and loopback-only target guard (resolveTarget). Playwright stays an optional tier (ADR-0005): package.json stays dependency-free and a missing browser runtime prints a "skipped (no browser runtime)" note and exits 0.

• New src/uiinteract.js — runInteractions, summarizeVerdict, verdictOutcome, recordInteraction.
• src/cli.js — uicheck interact subcommand.
• Docs — GUIDE uicheck section (now five subcommands) + CHANGELOG.md [Unreleased].

Checklist

• npm test passes (Node 18/20/22) — 685 tests, 683 pass, 0 fail (2 pre-existing skips); 7 new cases
• npm run check passes (Biome lint + format) — exit 0
• New public functions have a test
• Conventional commit message (feat:)
• CHANGELOG.md updated under ## [Unreleased]
• No new runtime dependency (dev deps ok) — Playwright resolved dynamically, optional
• Substrate/docs updated — verdict wires into the ledger via the behavioral oracle; GUIDE reconciled (forge docs check green)

Risk & rollback

• Risk level: low — new subcommand + module; no change to existing gates. The browser path mirrors the proven visualGate orchestration; absence is a graceful skip.
• Rollback plan: revert the commit; no persisted state or schema changes (verdicts are append-only, content-addressed evidence and only written with --record).

Extra checks

• npm run typecheck passes (tsc checkJs)
• Input validated at boundaries — target passes the loopback-only guard before any browser launches; unknown/absent runtime → skip, never throw
• Authorization/ownership — --remote still required for non-loopback targets (exfiltration guard unchanged)
• Logs contain no secrets/PII
• If AI-assisted: verified the Playwright + ledger APIs used; pure logic is unit-tested (browser path excluded from CI, exercised via the shared resolver)

🤖 Generated with Claude Code

---

Generated by Claude Code