feat(seo-data,seo,geo): R2 — refuse to score what JS paints; no Playwright

Arbitrated (user): honest refusal on SPA, no headless browser.

STEP 2 has recorded `RENDERING: SSR/SSG/SPA/hybrid` since forever and NOTHING
ever acted on it. (The inventory claimed a "SPA severely limited" §0 flag
compensated — it does not exist. Seventh subagent claim this branch has had to
disprove.) So on a client-rendered site the FULL audit curls an empty shell,
every meta/H1/JSON-LD check reports "missing", and the agent emits a page of
false findings — plus a bundle that would "fix" tags which already exist.

rendercheck reads the verdict from what the server SENT. package.json cannot
tell a React SPA from a Next.js SSR app; the served bytes can. Stdlib only.

The refusal is the point:
- client-rendered → On-page is N/A, excluded from the weighted global, NOT
  scored zero. A zero says "your on-page is bad"; N/A says "we could not see
  it". Only one is true, and /client-handover gates on this number.
- No bundle item may come from a live on-page check on such a site.
- The report still says what IS auditable (robots, sitemap, headers, config,
  CrUX field data — real users, hydration included — GSC, legal, images)
  rather than returning an empty verdict.
- geo refuses Content Shape the same way, and states the sharper fact: AI
  crawlers are WORSE at JS than Googlebot. GPTBot/PerplexityBot/ClaudeBot
  fetch HTML and largely do not execute it, so a client-rendered site is not
  merely unauditable by us — it is near-invisible to the engines this audit
  exists to serve. §0 alert + SSR/SSG as the top user action.

Script/style text is not page text: a React shell with a fat inline
window.__INITIAL_STATE__ measures 7 chars. Without that skip a 200 KB bundle
reads as a rich page — the detector would fail exactly where it matters.

Verified on both extremes, not just the happy path: zenquality 7650 chars/1
h1/9 jsonld and lavageangels356 13973/1/1 → server-rendered, no warning; a
Vite/React shell fixture → client-rendered, 7/0/0, warned.

seo-data 136 -> 144 pass, 0 fail; full suite green; shellcheck + py_compile
clean.

lib/seo-data/README.md

@@ -146,6 +146,29 @@ fetch.sh sitemap --url https://ex.com/sitemap.xml
       internals AND keeps this stdlib-only; defusedxml would drag in a venv for
       a document type that has no legitimate DTD.
 
+fetch.sh rendercheck --url https://ex.com/
+  → {"status":"ok","verdict":"server-rendered"|"client-rendered"|"partial",
+     "body_text_chars":7650,"h1_in_html":1,"jsonld_in_html":9,
+     "meta_description_in_html":true,"html_bytes":132447,
+     "warning":"…"}                       # warning only when not server-rendered
+
+  R2, the honest half of the SPA call. seo-analyzer has always recorded
+  `RENDERING: SSR/SSG/SPA` and never acted on it; this is the signal it acts
+  on. Verdict comes from what the server SENT — package.json cannot tell a
+  React SPA from a Next.js SSR app.
+    • client-rendered → the agent REFUSES to score On-page (N/A, not zero: a
+      zero says "your on-page is bad", N/A says "we could not see it"). Every
+      curl-based meta/H1/JSON-LD check would report "missing" against a site
+      that is fine once hydrated — false findings, and a bundle that "fixes"
+      tags which already exist.
+    • Does NOT render JS. No Playwright, no Chromium, no venv. Refusing IS the
+      finding.
+    • Script/style text is not page text: measured 7 chars on a React shell
+      whose inline window.__INITIAL_STATE__ is large. Without that, a 200 KB
+      bundle reads as a rich page.
+    • Measured 2026-07-17: zenquality 7650 chars/1 h1/9 jsonld and
+      lavageangels356 13973/1/1 → server-rendered; a Vite shell → 7/0/0.
+
 fetch.sh linkgraph --url https://ex.com/sitemap.xml [--max 500]
   → {"status":"ok","source":"linkgraph","pages_crawled":86,"pages_failed":0,
      "total_internal_links":2015,"capped":false,"max_depth":2,