Phase 3 v2: all step automations + cross-cutting UI

Step automations (six more):
- Step 3 (Core): current vs latest WP version, db upgrade flag, auto-
  update policy, safe-update sequence reminder.
- Step 5 (Theme): parent/child detection, customisation warning when
  non-default theme without child, theme update available, inactive
  theme list.
- Step 6 (Visual): mShots screenshot URL, key-page HEAD checks (home,
  login, posts page, WC shop/cart/checkout), mixed-content scan.
- Step 7 (Performance): keyless PageSpeed Insights v5 API (mobile +
  desktop, cached 12h, skipped on .local), caching plugin detection,
  heavy-image scan (>500KB).
- Step 10 (Uptime): monitoring plugin detection (ManageWP, MainWP,
  Jetpack, WP Umbrella, UptimeRobot), www/non-www canonical check.
- Step 12 (Wrap-up): cross-step rollup — bad/warn counts, blocked
  steps, top examples for the technician's final glance.

Cross-cutting:
- Sticky step-index sidebar with status dots per step (the linear-
  stepper alternative that keeps the overview).
- 'Stop & escalate' summary card at top listing blocked steps with
  escalation guidance and notes.
- Previous-session snapshot stored on finish; diff banner on the next
  session shows new/resolved/changed counts.
- HTML report builder (printable, inline-styled). Download HTML,
  Download Markdown, Copy, and Email actions on the finish panel.
  Email uses wp_mail with text/html.

Smoke-tested on testsite: all 12 steps return findings (5/9/4 by level
on a fresh local install), admin page renders with all UI markers,
HTML report is 26KB, Markdown report is 13KB, prev-session diff banner
appears on second session.

Deferred:
- hc-5ix.27 self-hosted update channel — needs hosting infra.
- Full PDF report — would need vendoring Dompdf.
- Step 3 safe-mode update wizard — worth its own bead.

includes/steps/30-core.php

@@ -18,4 +18,64 @@ return new class extends WPH_Step {
             'White screen of death post-update, admin redirect loops, missing admin menu items — these usually indicate a theme or plugin conflict with the new core version.',
         ];
     }
+
+    public function autocheck(array $session_state): array {
+        global $wp_version;
+        $f = [];
+
+        if (!function_exists('get_core_updates')) require_once ABSPATH . 'wp-admin/includes/update.php';
+        $updates = function_exists('get_core_updates') ? get_core_updates(['dismissed' => true]) : [];
+        $latest = (!empty($updates) && !empty($updates[0]->current)) ? $updates[0]->current : $wp_version;
+        $behind = version_compare($wp_version, $latest, '<');
+
+        $f[] = $this->finding(
+            'wp_current',
+            'info',
+            'Currently installed',
+            $wp_version,
+            ''
+        );
+        $f[] = $this->finding(
+            'wp_latest',
+            $behind ? 'warn' : 'ok',
+            'Latest available',
+            $latest,
+            $behind ? 'Update available → ' . admin_url('update-core.php') : 'Up to date.'
+        );
+
+        // Database upgrade required?
+        if (function_exists('wp_get_db_schema')) {
+            $required = (int) get_option('db_version');
+            global $wp_db_version;
+            if ($required > 0 && $wp_db_version > $required) {
+                $f[] = $this->finding('db_upgrade', 'warn', 'Database upgrade', 'pending', 'WP code is at v' . $wp_db_version . ', database at v' . $required . '. Visit /wp-admin/upgrade.php.');
+            } else {
+                $f[] = $this->finding('db_upgrade', 'ok', 'Database upgrade', 'not needed', '');
+            }
+        }
+
+        // Auto-updates configured?
+        $core_auto = get_site_option('auto_update_core_major', null);
+        if ($core_auto === null) $core_auto = defined('WP_AUTO_UPDATE_CORE') ? (string) WP_AUTO_UPDATE_CORE : 'minor';
+        $f[] = $this->finding(
+            'auto_update',
+            'info',
+            'Core auto-update policy',
+            (string) $core_auto,
+            'Configured via Updates → Auto-updates or the WP_AUTO_UPDATE_CORE constant.'
+        );
+
+        // Safe-mode update guidance — not an action, just a reminder.
+        if ($behind) {
+            $f[] = $this->finding(
+                'safe_mode_hint',
+                'info',
+                'Safe-update sequence',
+                'see detail',
+                'Deactivate non-essential plugins → run the update → smoke-load front-end + wp-admin → reactivate plugins.'
+            );
+        }
+
+        return $f;
+    }
 };