feat: momentum metrics, agents.yml validation, drift detection, hardening (#9)

Review fixes:
- applyMigrations resolves chained renames deterministically (cycle guard)
- GraphQL errors name the failing owner/repo, not the alias
- sanitizeCell escapes backslash + angle brackets (README md/HTML injection)
- timeNow/graphqlURL seams; new httptest fetch tests, site + delta tests
  (coverage 30% -> 65.6%)

Features:
- delta30d computed from history; dashboard gains sortable D30d column
- README shows Top 7-day mover line
- 'go run . -check' validates agents.yml offline (dupes, categories,
  name patterns); wired into CI for contributor PRs
- isArchived + rename drift warnings in daily run; archived badge on
  dashboard (E2E found 3 archived repos: gpt-engineer, void, Roo-Code)

.github/workflows/ci.yml

@@ -9,6 +9,8 @@ on:
       - 'go.mod'
       - 'go.sum'
       - '.github/workflows/ci.yml'
+      - 'data/agents.yml'
+      - 'templates/**'
 
 permissions:
   contents: read
@@ -27,6 +29,7 @@ jobs:
       - run: go vet ./...
       - run: go test ./...
       - run: go build ./...
+      - run: go run . -check
 
   lint:
     runs-on: ubuntu-latest