[codex] Mature repo framework audits

[PSkinnerTech]

Summary

• Adds deterministic Next.js and Astro fixture repositories for repo audit coverage.
• Adds stable Next.js prerender-manifest evidence, manifest/static-output parity findings, and Markdown/golden summary coverage.
• Hardens framework manifest handling with path containment, unknown-schema fail-closed behavior, temp fixture copies for parallel test safety, and validation coverage for the new Phase C assets.

Notes

Astro coverage is intentionally limited to framework detection and static-output auditing in this phase. Astro route metadata should come from an explicit integration-generated artifact rather than an inferred .astro/manifest.json file.

Test Plan

• node --test packages/cli/test/repo-manifests.test.mjs packages/cli/test/repo-audit.test.mjs packages/cli/test/golden-fixtures.test.mjs
• npm test -> 178/178 passing
• npm run validate -> ok: true
• git diff --check