T7.10 - D5: one analytics implementation, and its report on the admin console

Usage analytics existed as five of the nine colliding globals creator-frame.md
counted (ANALYTICS_KEY, analyticsLoad, analyticsSave, downloadAnalytics,
showAnalytics), twice - and the wizard's copy had no caller, because the
button lived on the creator. The admin console had a THIRD private reader
(usageLoad/downloadUsage) that only saw the wizard's key.

Now: ONE core, html/wp-usage.js (window.WPUsage: load/save/track/download +
the two pre-move storage keys, verbatim). The creator and wizard keep only a
thin track() wrapper - page state like the creator's dev-mode pause belongs
to the page - and record exactly what they recorded before, under the same
keys, so everything captured before this task still reads (probe plants a
legacy-format event and finds it in the report). The "Usage data" button left
the creator toolbar; the report lives in admin.html's usage card, covering
BOTH tools with a download each, behind the same admin gate as the rest of
the console (a non-admin sees the denied card and nothing else), usable at
390px.

Two probes re-pointed, both with the reason in the code:
- cards_check pinned admin.js byte-identical to HEAD - right for T6.5, but as
  a standing probe it would fail every legitimate later edit; D5 targets
  admin.js by name. A7's localization is protected by the feature checks and
  the end-to-end drive, plus a wiring assertion on the block itself.
- frame_check listed "Usage data" among the toolbar buttons that must be
  visible; it now asserts the button is GONE, so the duplicate cannot quietly
  return.

Verification (each probe run alone): NEW tests/usage_check.py 15/15 (grep
half: WPUsage defined once, no page touches the keys directly, none of the
five globals survives anywhere). Regressions: cards_check ALL PASS,
frame_check 39/39.

Items: D5

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/cards_check.py

@@ -235,10 +235,17 @@ def run(page, base, tok, db_path):
     for needle in ("Localization defaults", "L10N_LOCALES", "L10N_ZONES",
                    "fillLocalization", "saveLocalization", "set-locale", "set-tz"):
         chk("admin.js still has %s" % needle, needle in src)
-    changed = subprocess.run(
-        ["git", "diff", "--stat", "HEAD", "--", "html/admin.js"],
-        cwd=ROOT, capture_output=True, text=True).stdout.strip()
-    chk("...and this task changed nothing in it at all", not changed, changed)
+    # Re-pointed at T7.10, not relaxed. This asserted admin.js was byte-identical
+    # to HEAD - right for T6.5, whose task touched nothing there, but as a
+    # standing probe it failed every LEGITIMATE later edit (D5 moved the usage
+    # report into admin.js by name). A7's protection is the feature checks above
+    # plus the end-to-end localization drive - so pin the localization BLOCK
+    # instead: its functions must not merely exist, they must be uncalled by
+    # nothing, i.e. still wired to the controls that ship the feature.
+    chk("...and the localization block is still wired to its controls",
+        "fillLocalization()" in src
+        and 'onclick="saveLocalization()"' in src
+        and "set-locale" in src)
 
 
 def main():