- check <source>: open checkUrl, assert loggedInSelector (exit 3 when
  logged out); login <source>: recipe-driven multi-step form flow with
  $USER/$PASS substitution from NH_LOGIN_* env, tab-relocation hardening
  against concurrent harvests, post-login verification
- recipes live in logins/<source>.json; ships digitimes-feed.json
- honors CDP_PORT_OVERRIDE / CDP_PROFILE_OVERRIDE (per-source instances)

Pair with CDP_PORT_OVERRIDE so parallel harvests can each drive a
dedicated Chromium instance (own port + own user-data-dir).

- pack.js: --pattern (articleUrlPattern) for direct sources; recipe no
  longer required (and forbidden) for --method direct, since a recipe
  forces the browser path at harvest time
- source-manage.js install: carry bundle articleUrlPattern into config
- fetcher-direct.js: decode HTML entities in title/img alt
- new wccftech-news direct bundle (server-rendered WordPress, no login,
  no Chromium); verified end-to-end via harvest --preview
- docs: SKILL.md, recipe-guide.md, source-management.md updated