Integrate CarMax PR #57 with reviewed fixes and harder tasks

[QianhuiWu]

Summary

Follow-up integration PR for #57, retaining the CarMax contribution from #24 and
the review commit from #57, followed by the reviewed fixes. Please use a regular
merge, not squash or rebase, to preserve the original authors and dependency history.

• Restore make → model → year value browsing; fix pagination and mobile layouts.
• Replace LLM-dependent graders with offline navigation, answer-field/unit/date,
  and exact saved-database delta checks. Missing snapshots fail closed.
• Coordinate task wording and answer-free judge rubrics with the verifiers.
  Expand tasks 12, 16 and 19 into account-specific multi-page research and
  comparison workflows: 5 / 5 / 4 → 12 / 12 / 12 recorded steps.
• Append CarMax at index 37 / port 40037 without moving existing sites; reconcile
  registries, Docker EXPOSE and documentation with main.
• Pin CarMax's original immutable HF bundle independently; use explicit missing
  image fallback and disclose representative stock imagery. Remove accidentally
  tracked runtime databases, retaining the original seed.

History and attribution

• Original site: Zihao Li (@Violet24K), Add CarMax mirror (port 40015) #24,
  4220681.
• Reviewer continuation: DEM1TASSE, Add CarMax mirror + task verifiers (site by @Violet24K, verifiers by reviewer) #57,
  701247f.
• Follow-up: main integration 47c9bb5, functional/grading fixes 721aced,
  and harder-task contracts 2a40f17.

Both original PR heads are actual ancestors of this branch, not copied or
squashed replacements. The separate closed #56 had already been superseded by
#57; no new history-only reconciliation was added.

Validation

• 20/20 selected browser trajectories pass the official offline grading entrypoint.
• 44/44 harder-task grading controls match expectations: 41 negatives rejected,
  three equivalent-format positives accepted. Previous functional-fix controls:
  37 targeted outcomes plus 60 no-op/wrong-answer/navigation controls matched.
• 16 unit/route tests pass; Python syntax, diff whitespace and 38-site registry
  checks pass.
• Organized dashboard: 20 GIFs, 232 recorded steps = 192 task actions + 40
  viewport checks. Revised GIFs, desktop/mobile layouts, filters and deep links
  verified; original evidence retained separately.
• Full build at commit 2a40f17 using the freshly
  downloaded CarMax pin: PASS. Image webharbor:pr57-integration-20260917,
  sha256:4a75378e6d247d03d139fb3191975b6b11e37fc16ca4f77ffb5b6bdcc6cbda71.
• All 38 site homepages return 200; all 38 services are healthy/ready.
  CarMax reset after a deliberate runtime mutation restores byte-identical seed
  contents; restart and reset-all pass. The disposable container was stopped.
• Tasks 12, 16 and 19 replayed again against that clean-pin Docker image:
  all complete in 12 steps and pass official grading, with no browser errors
  or 390px document overflow. All 78 tracked CarMax runtime files match the
  candidate checkout.

The recordings are scripted UI regressions, not independent LLM-agent discovery.
No secondary LLM judge was run because no API key was configured.

Asset and release limitations

The merge candidate uses the freshly downloaded original CarMax asset pin
189b9cdcfd41a21b99ce4797f3bec152d8564a7f. Its seed is unchanged. The 11 newly
recovered photos are a local supplement, documented in recovered_assets.json;
they are not published by this code PR. A fresh checkout uses explicit
placeholders for those photos until a separate HF bundle publication and pin
update. Seven other model-year photos remain unavailable/unsuitable. The fuller
local review preview therefore has more photos than the pinned-bundle build.

This PR merges source only. It does not publish a Docker image or deploy a service.