Plugin: add Google Analytics + Search Console healthcheck steps (hc-u5c)

Slot two new steps between performance (Step 7) and security (Step 8):

- 72-analytics.php: sniffs the homepage for GA4 (G-), GTM, and legacy UA
  measurement IDs plus known loader URLs (gtag.js, gtm.js, analytics.js,
  ga.js) and detects common analytics/tag plugins. Warns if only UA is
  still in use.

- 74-search-console.php: looks for google-site-verification meta tags on
  the homepage, probes for a reachable sitemap (wp-sitemap.xml, then
  sitemap_index.xml, then sitemap.xml), parses robots.txt for a
  Googlebot/* Disallow: /, flags the WP "Discourage search engines"
  setting when on, and notes whether Site Kit is active.

Titles use the "Step —" (unnumbered) convention already used by the
email and handover steps so the existing numbered steps don't shift.
steps.md updated to match.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

steps.md

@@ -101,6 +101,35 @@ Do a manual walkthrough of the site:
 
 ---
 
+### Step — Google Analytics Check
+
+Confirm the site is still reporting into Google Analytics.
+
+- Confirm a tracking snippet is present on the homepage (view source, look for gtag/GTM/analytics.js)
+- Log into Google Analytics and confirm real-time users are being recorded when you load the site
+- Confirm the measurement ID on the site matches the client record (G-XXXX for GA4, GTM-XXXX for Tag Manager)
+- Check that today has page-view events in the property — flag if traffic has dropped to zero
+- Flag if only Universal Analytics (UA-XXXX) is still in use — GA4 has been required since July 2023
+
+**Watch out for:** cookie/consent banners that block the tracker until accepted; caching/optimisation plugins that defer or strip inline scripts.
+
+---
+
+### Step — Google Search Console Check
+
+Confirm the site is still verified and Google can crawl/index it.
+
+- Log into Google Search Console and confirm the property is still verified
+- Check the Pages / Coverage report for new indexing errors since the last healthcheck
+- Confirm the sitemap is submitted and its "Last read" date is recent
+- Skim the Performance report — flag significant drops in impressions or clicks (>25% vs. previous period)
+- Check Manual Actions and Security Issues — flag anything that is not "No issues detected"
+- Confirm the verified property matches the canonical URL (http vs https, www vs non-www) actually serving
+
+**Watch out for:** a missing verification meta tag doesn't mean unverified — DNS TXT and file-based verification are equally valid.
+
+---
+
 ### Step 8 — Security Check
 
 - Confirm the SSL certificate is valid and not expiring within 30 days — flag if so