fix(test): the layout harness could not run against the deployed site

It reached into each iframe and evaluated a string there to load the audit.
GitHub Pages forbids that outright, so every check on the live site came back
as a content-security-policy error while localhost stayed green. The deployed
copy is the one a judge opens, so a harness that only works on a dev server is
measuring the wrong thing.

auditPage now takes the window to measure, and the harness imports it once and
passes each frame in. Waits went from 6s to 15s, since a timeout expiring
against a remote host surfaced as "cannot read properties of null" and read
like a bug in the page rather than in this file.