🤖 Behaviour suite

The same tests for every app, run twice: once with JavaScript on (js-on) and once with it off (js-off).

scripts/test-app.sh <base-url> [results.json]

• todomvc.spec.ts: the 29 tests of TodoMVC's own Cypress suite (tastejs/todomvc/cypress/e2e/spec.cy.js), ported. Each test gets a fresh browser context, so a fresh cookie and an empty list. Persistence is checked by reloading, and routing uses real paths. With JS off, "save edits on blur" and "cancel edits on escape" are skipped, and editing goes through the edit link.
• robustness.spec.ts: HTML in titles, UTF-8 and Content-Length, blank and very long titles, per-visitor isolation and garbled cookies, and cross-site and cross-list POSTs.
• visual.spec.ts: with JS on, the page must match a screenshot of shared/reference.html within 2% of pixels, with footer.info masked. To regenerate the golden image: npm run golden.

Against the reference fixture (2026-10-23): 67 passed, 3 skipped (the two JS-only edit tests and the screenshot test with JS off). Each of these deliberate breaks was caught: a 500 on a foreign id, unescaped titles, #/ filter links, untrimmed edits, and no-JS controls visible with JS on.