traffic-replaylisted

# traffic-replay — captured traffic → non-regression conditions Shift-right gap this closes: `perf-check`/`security-surface`/`a11y-audit` are active checks run against a live app; nothing else in QAIA derives test conditions from **real traffic that already happened**. It works the way every analysis skill in this plugin works: read an artifact the user already has and report only what it shows — the same anti-fabrication discipline as ingestion (honest recall beats fabricated recall: never assert more than the artifact supports), and the same mask-before-write discipline, extended here from user-story text to HTTP traffic. Reference fixture: `fixture/` in this skill folder — a fully **synthetic** HAR (`demo-traffic.har`) for a fictional app ("TaskFlow"), hand-built for this validation, never real production data (the issue's own acceptance criterion). It deliberately contains an `Authorization` header, a session cookie, a query-string token, an email, a phone number, a full name and a card number, so the masking step has real sensitive-shaped values to catch. See `fixture/VALIDATION.md` for the worked example and the grep proof that none of the injected values leak into the output artifacts. ## Input - A **HAR file (HAR 1.2)** the user provides — exported from a browser's DevTools Network panel, or an equivalent proxy/tool export the user already has. **Never captured live by this skill**: no proxy, no MITM, no browser automation to *generate* new traffic, no network