wcag: preserve report dates and correct W3C hand-off

[ralyodio]

Opening a wcag report evaluation in the live W3C WCAG-EM Report Tool 4.1.0 silently dropped the evaluation date because its importer reads a typed JSON-LD value. Emit that value as a calendar date while preserving precise assertion timestamps.

Correct the hand-off to the current “Open report” action, explain how to reveal imported page findings, and identify the JSON download action. The report's entire-sample outcomes remain for the evaluator to complete.

Validation:

• 44 WCAG tests pass, including the date regression.
• Focused TypeScript check passes with the repository's strict compiler options.
• Audited three live profullstack.com pages, opened the generated file in real Chrome at https://www.w3.org/WAI/eval/report-tool/, inspected its scope/sample/findings, and downloaded it using the UI. All 33 criterion/page/outcome/description records and three sampled pages survived; the corrected date displays and round-trips as 2026-09-13. Results remain two failed and 31 cannot-tell assertions, with zero passed.
• Repository-wide pnpm typecheck remains blocked by existing errors in src/argontv.ts:213 and src/free-names.ts:80,89.

The W3C tool itself rewrites imported assertion mode to earl:manual on export; descriptions retain automated provenance. This validation does not complete manual accessibility review.

[github-actions]

ThreatCrush Security Scan

13 finding(s)

HIGH/CRITICAL: 4 | MEDIUM: 5 | LOW: 4

Severity	Rule	Location
HIGH	sh-remote-script-execution	root-ubuntu.sh:3227
HIGH	sh-remote-script-execution	root-ubuntu.sh:3228
HIGH	sh-remote-script-execution	root-ubuntu.sh:4840
HIGH	sh-remote-script-execution	root-ubuntu.sh:4844
MEDIUM	sh-remote-script-execution	root-ubuntu.sh:4993
MEDIUM	sh-remote-script-execution	root-ubuntu.sh:6055
MEDIUM	redos-nested-quantifier	src/domain-free.ts:56
MEDIUM	redos-nested-quantifier	src/mail.ts:1042
MEDIUM	redos-nested-quantifier	src/wcag.ts:556
LOW	secret-generic-credential	src/credentials.ts:36
LOW	secret-generic-api-key	test/credentials.test.ts:208
LOW	secret-generic-credential	test/mail.test.ts:140
LOW	secret-generic-credential	test/shorten.test.ts:36

Snippets are redacted; ThreatCrush never prints matched credential material.