feat(recipe-report): restructure page — priority-sorted wire table w/ CVE column, addendum, per-recipe changes

New page order: short lead -> the full wire table (sorted by priority-to-address,
CVE recipes first, new CVEs count column) -> Addendum (bullets of real special
issues, omitted if clean) -> Security Bulletin -> per-recipe "What changed".

- recipe-report.py: _table() gains a CVEs column + recipe-name linking; new
  _changes() helper; render() reordered; docstring SPEC SHAPE updated
  (cve/addendum/changes added, needs_attention/routine removed).
- recipe-report/SKILL.md + example-spec.json: new procedure, spec shape, and
  gold-standard template (2026-06-05, new format).
- launch-report.py: kickoff text reflects the new priority-ordered structure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cc-ci-plan/launch-report.py

@@ -44,8 +44,8 @@ def build_kickoff(date):
         f"Full spec: {WORKDIR}/.claude/skills/recipe-report/SKILL.md. Creds in {WORKDIR}/.testenv; "
         f"reach the CI server with `ssh cc-ci`.\n"
         f"You are READ-ONLY: review the latest /upgrade-all run + every recipe's open PRs + CI verdicts, "
-        f"classify needs-attention vs routine, and publish one HTML page per run to "
-        f"report.ci.commoninternet.net (+ regenerate the index). Public page — NO secrets/tokens/raw logs. "
+        f"order the wire table by priority-to-address (CVE recipes first), and publish one HTML page per "
+        f"run to report.ci.commoninternet.net (+ regenerate the index). Public page — NO secrets/tokens/raw logs. "
         f"Never merge/edit/comment on PRs. When done, print the report URL + 'RECIPE REPORT COMPLETE' and "
         f"go idle (do NOT loop)."
     )