Add the mobile performance playbook to the audit skill

[arzafran]

What this does

Turns the shield.fi optimization pass into something the audit and lighthouse skills apply on any site: a measured fix ladder, the false findings to discard first, and two scripts that produce the numbers. No new skill; the count stays at 38.

Summary

Start with skills/audit/references/performance-playbook.md.

1. The playbook: measurement kit and honesty rules (same host, real Chrome binary, Lantern vs observed LCP, DevTools preset arithmetic), artifacts to discard (extension injected.js, DevTools panel CLS, warm-cache panels, preview toolbar), an eight-rung fix ladder with the effect each one measured (AVIF, unused client code, inline CSS, per-route CSS chunking, font subsetting with unicode-range, platform elements over client widgets, WebGL gated on the renderer string, scroll libraries on touch), the traps found on the way, and the report shape.
2. net-capture.mjs: cold load under emulated Slow 3G / 3G / 4G with 4x CPU, prints requests, bytes by type, TTFB/FCP/LCP/load and a request timeline. BLOCK regex aborts a resource class for what-does-paint-wait-on experiments.
3. bundle-attribution.py: attributes a route's shipped JS to packages and app directories from source maps; separates the framework floor from what the project controls.
4. Pointers from the audit skill's Performance mode (Phase 1) and the lighthouse skill's diagnose section, including the PageSpeed "page stopped responding" case.

Test plan

• bun run lint:skills: 38 skills, 0 errors
• bun run lint:links: 190 links ok
• bun run typecheck clean
• Both scripts run against a live site (33 requests / 416 KB; 15 chunks / 194.7 KB gz)
• bun run lint and 14 tests (codex shim detection, npm installer stub, setup.sh bootstrap) fail on main the same way; untouched here