Check the signed-in markup from a scheduled workflow

Move the authenticated drift check into the repository as
tools/compat_auth.py, run daily by .github/workflows/compat-auth.yml on the
maintainer's forge only. Credentials come from FH_EMAIL and FH_PASSWORD, the
output is pass/fail labels only because the run log is public, and a failed
run pushes the report to ntfy. Exit 5 means all hold, 10 drift, anything
else that it could not run.

Point compat.yml, tools/compat.py and the docs at it, add a README section,
and cut 0.5.1.

tools/compat.py

@@ -10,11 +10,10 @@ schedule and fails when the site moves.
 WHAT THIS CAN AND CANNOT SEE
 ----------------------------
 Only the *unauthenticated* surface is checked here: the login handshake and the
-Algolia catalogue. The authenticated contract — dashboard markup, cart add
-hashes, skip popups, subscribe forms — needs a real session, and the only way to
-give public CI one is to put a personal grocery account's password in repo
-secrets. That is not worth it for a drift check. Those assumptions belong in a
-fleet job on a host that already has credential access; see README.
+Algolia catalogue, so it runs anywhere. The authenticated contract — dashboard
+markup, cart add hashes, skip popups, subscribe forms — needs a real session.
+tools/compat_auth.py checks that half, from a workflow that runs only on the
+maintainer's forge, where the account credentials are; see README.
 
 Exit code is the number of FAILED checks, so CI fails loudly on drift.
 """