feat(netlify): run a baseline check on every site

[twistedmelonman]

What changes

netlify-site-checks.yml now runs a built-in baseline check on every
site, before the caller's own check script. A Netlify site with no check
script (smartwatermelon/crazy-larry) now gets checked too, and its caller
needs no change.

• netlify/baseline-check.sh <base-url>: GET / must return 200
  (redirects followed; 10s connect timeout, 30s max, 2 retries). The body
  must be at least 1024 bytes and contain a <title> element. It prints
  ok: / FAIL: lines. Exit 0 = sane, 1 = not, 2 = usage.
• netlify/select-check-script.sh makes the check-script decision. It
  still runs before the 10-minute wait:
  • The default path (scripts/check-deploy-preview.sh) is absent: the
    script is skipped with a ::notice::, and only the baseline check runs.
  • Any other path is absent: the run fails with exit 2, to catch a typo.
  • The file is present but not executable: the run fails with exit 2, as
    before.
• The "Check the served site" step now runs only when the selector says so.

The selector cannot tell a default left in place from the default path
passed explicitly, so both get the skip. The README says so. A test pins
the selector's hard-coded default to the workflow input's default, so the
two cannot drift apart.

Testing

• bash tests/run-tests.sh: all 7 files pass. The new
  tests/test-baseline-check.sh passes 15/15 against a stub curl in
  tests/stub-baseline/. It covers pass, non-200, connection failure,
  short body, missing title, usage errors, and the four selector outcomes.
• Mutation check: with the byte floor dropped and the title match removed,
  the short-body and missing-title cases fail as they should.
• shellcheck -S info is clean on every new script. zizmor reports no
  findings. actionlint reports one finding, job.workflow_sha unknown on
  an unchanged line. The same finding appears on main and in
  standards-check.yml, so it predates this change.

Release

This change reaches callers only after a release, and both steps need
Andrew's authorization:

1. Create the exact tag netlify-site-checks-v1.1.0 on the merge commit.
2. Move the floating netlify-site-checks-v1 tag to it.

This PR creates and moves no tags.

Advances smartwatermelon/dev-env#193