Phase 3 v2: all step automations + cross-cutting UI

Step automations (six more):
- Step 3 (Core): current vs latest WP version, db upgrade flag, auto-
  update policy, safe-update sequence reminder.
- Step 5 (Theme): parent/child detection, customisation warning when
  non-default theme without child, theme update available, inactive
  theme list.
- Step 6 (Visual): mShots screenshot URL, key-page HEAD checks (home,
  login, posts page, WC shop/cart/checkout), mixed-content scan.
- Step 7 (Performance): keyless PageSpeed Insights v5 API (mobile +
  desktop, cached 12h, skipped on .local), caching plugin detection,
  heavy-image scan (>500KB).
- Step 10 (Uptime): monitoring plugin detection (ManageWP, MainWP,
  Jetpack, WP Umbrella, UptimeRobot), www/non-www canonical check.
- Step 12 (Wrap-up): cross-step rollup — bad/warn counts, blocked
  steps, top examples for the technician's final glance.

Cross-cutting:
- Sticky step-index sidebar with status dots per step (the linear-
  stepper alternative that keeps the overview).
- 'Stop & escalate' summary card at top listing blocked steps with
  escalation guidance and notes.
- Previous-session snapshot stored on finish; diff banner on the next
  session shows new/resolved/changed counts.
- HTML report builder (printable, inline-styled). Download HTML,
  Download Markdown, Copy, and Email actions on the finish panel.
  Email uses wp_mail with text/html.

Smoke-tested on testsite: all 12 steps return findings (5/9/4 by level
on a fresh local install), admin page renders with all UI markers,
HTML report is 26KB, Markdown report is 13KB, prev-session diff banner
appears on second session.

Deferred:
- hc-5ix.27 self-hosted update channel — needs hosting infra.
- Full PDF report — would need vendoring Dompdf.
- Step 3 safe-mode update wizard — worth its own bead.

includes/steps/100-uptime.php

@@ -10,4 +10,51 @@ return new class extends WPH_Step {
             'Confirm the site is resolving correctly on both www and non-www',
         ];
     }
+
+    public function autocheck(array $session_state): array {
+        $f = [];
+
+        // Known monitoring plugins
+        $monitors = [
+            'worker/init.php'                                  => 'ManageWP Worker',
+            'mainwp-child/mainwp-child.php'                    => 'MainWP Child',
+            'jetpack/jetpack.php'                              => 'Jetpack',
+            'wp-umbrella/wp-umbrella.php'                      => 'WP Umbrella',
+            'uptime-robot/uptime-robot.php'                    => 'UptimeRobot',
+        ];
+        $detected = [];
+        foreach ($monitors as $file => $label) {
+            if (function_exists('is_plugin_active') && is_plugin_active($file)) $detected[] = $label;
+        }
+        $f[] = $this->finding(
+            'monitor_plugin',
+            $detected ? 'ok' : 'info',
+            'Monitoring plugin',
+            $detected ? implode(', ', $detected) : 'none detected',
+            $detected ? 'Pull downtime stats from the relevant dashboard.' : 'External monitoring (UptimeRobot/BetterStack/Pingdom) may still be in place.'
+        );
+
+        // www vs non-www: try fetching both and see whether one redirects to the other
+        $home = home_url('/');
+        $parts = parse_url($home);
+        $host  = $parts['host'] ?? '';
+        $scheme = $parts['scheme'] ?? 'https';
+        if ($host) {
+            $with_www    = $scheme . '://' . (strpos($host, 'www.') === 0 ? $host : 'www.' . $host) . '/';
+            $without_www = $scheme . '://' . preg_replace('/^www\./', '', $host) . '/';
+            foreach (['with www' => $with_www, 'without www' => $without_www] as $label => $url) {
+                $resp = wp_remote_head($url, ['timeout' => 5, 'redirection' => 0]);
+                if (is_wp_error($resp)) {
+                    $f[] = $this->finding('canonical_' . sanitize_key($label), 'warn', $label, $url, $resp->get_error_message());
+                    continue;
+                }
+                $code = wp_remote_retrieve_response_code($resp);
+                $loc  = wp_remote_retrieve_header($resp, 'location');
+                $detail = $loc ? '→ ' . $loc : '';
+                $f[] = $this->finding('canonical_' . sanitize_key($label), 'info', $label, 'HTTP ' . $code, $detail);
+            }
+        }
+
+        return $f;
+    }
 };