review(bandcamp): add deterministic task verifiers

[reacher-z]

Reviewer contribution

This builds on #36 while preserving XuanRui LI's original Bandcamp commit and authorship. The reviewer changes are isolated in a second commit.

What changed

• rebased the Bandcamp mirror onto current main, retaining Merriam-Webster and assigning Bandcamp the next available port 40016
• added deterministic verifiers for all 18 tasks, with required-navigation checks to reject prior-knowledge shortcuts
• added SQLite before/after verification for wishlist, cart, checkout, and profile-update tasks
• supplied exact seeded credentials for each standalone authenticated task
• added explicit judge_rubric and verifier_path contracts without leaking an answer field
• corrected site registration, Docker exposure, startup/health counts, and README port documentation

Verification

• python3 -m unittest discover -s sites/bandcamp/verify -p 'test_*.py' -v: 7 test groups pass
• positive, no-op, wrong-answer, and prior-knowledge cases cover all 18 tasks
• all four stateful false-claim cases fail without the corresponding database transition
• every verifier wrapper was exercised for both pass and fail exit codes
• py_compile, JSONL parsing, shell syntax, git diff --check, and asset checks pass
• Docker runtime health reports 17/17 mirrors alive
• wishlist, cart, checkout, and profile flows were executed through real HTTP and passed live SQLite before/after checks
• browser QA covered the homepage, release/merch pages, login, cart, checkout, orders, and profile editing

Asset dependency

The companion asset submission remains ChilleD/WebHarbor discussion #26. It should be merged/pinned before this environment is treated as self-contained.

This branch independently uses the next free port on current main. If the Cookpad reviewer PR #78 lands first, I will rebase this branch and move Bandcamp to 40017 so both environments remain conflict-free.