Site-audit builder tests: local_date, the at-pin hash, a data source's page hash, readme_url and merged_prs are unchecked

[realmarcin]

From the round-2 review of #265 (follows #266).

Where: tests/test_fleet_page.py SiteAuditBuilderTests.

Mutations that pass all 84 tests:

• local_date computed from the UTC date, the site_audit.json's local_date disagrees with its checked_at_utc after the September 25 rebuild #178 bug class;
• the at-pin hash computed from the live body;
• a data source's page hash computed from the data file;
• readme_url linked to main instead of the pin;
• merged_prs set to 0;
• a grown site's live hash computed from the pinned copy.

Fix: assert each of these fields against known inputs, using a non-UTC now.