feat: park the two policy changes the pricing plan forbids; robots.txt stands in

The third --apply of 2026-09-04 reached update-distribution and was rejected
atomically: "Distributions with the Free pricing plan can't have the following
features: Custom origin request policy, Custom response headers policy."
Pouya's ruling: both are PARKED as unavailable — a platform constraint, not a
defect.

The pre-flight added in the previous commit could not have caught this, and
that is the point: every limit in PAYLOAD_LIMITS is a property of the payload,
while this is a property of the account, reported only by the call the
pre-flight exists to avoid. Both sections now stop before creating anything.

The plan is not in the CloudFront API — checked across 167 operations, no
operation, shape, member or documentation string mentions one, and
PriceClass_All is the edge-location price class, not the plan. So the gate is a
constant, PLAN_ALLOWS_CUSTOM_POLICIES, and the two sections report as PARKED
under their own heading rather than as skips: the previous commit made a skip
exit 3, and a constraint true on every run would have made 3 permanent. Proven
with a shim that refuses every mutating verb: --apply now makes zero of them.

Substitute (a): Disallow: /pouya-lajevardi-bio.pdf in robots.txt, placed before
Allow:/ so first-match crawlers honour it too. It is not an equivalent and the
file says so — it stops the PDF being fetched, solving the duplicate-of-/bio/
problem, but does not de-index a URL linked from /bio/ and /about/. Verified:
syntax, a match simulation under both crawler semantics, and that the sitemap
does not list the PDF.

Substitute (b): the WAF web ACL CreatedByCloudFront-f8fbf256 is already
attached — 925 WCU, three AWS managed rule groups, no rate-based statement.
That corrects §9 Q65, which framed WAF as a cost decision about adding one and
named the now-unappliable header forwarding as its groundwork. The real
question is one rule on an ACL already paid for, and a rate-based rule matches
the viewer address directly, so the capability is superseded rather than lost.

Reviewed in two rounds by me rather than a separate agent, per instruction.

Nothing was applied to the distribution and nothing was deployed; robots.txt
needs one site deploy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

docs/04-seo-spec.md

@@ -153,7 +153,20 @@ here.** This spec used to reproduce the file inline and the reproduction had
 already drifted from it by 2026-08-26, which is the failure mode the `AGENTS.md`
 §7 rule exists to stop.
 
-**It disallows nothing, and that is deliberate.** This spec previously
+**It disallows exactly one path, and everything about that exception is in the
+file.** ⚠️ **THIS READ "It disallows nothing, and that is deliberate" UNTIL
+2026-09-04.** `Disallow: /pouya-lajevardi-bio.pdf` was added that day as the
+stand-in for `X-Robots-Tag: noindex` on `*.pdf`, which needs a CloudFront
+response-headers policy the distribution's pricing plan forbids (`AGENTS.md` §7).
+
+⚠️ **IT IS A SUBSTITUTE, NOT AN EQUIVALENT, AND THE RULE BELOW IS WHY.** It stops
+the PDF being *fetched* — so its contents are never indexed and the
+duplicate-of-`/bio/` problem is solved — but it does **not** de-index the URL,
+and the PDF is linked from `/bio/` and `/about/`, so a bare listing remains
+possible. That residual is accepted deliberately. **The rule below is unchanged
+and this is its exception, not its repeal.**
+
+The general rule: this spec previously
 prescribed `Disallow: /legal/` alongside `noindex` on those pages, and the two
 cancel each other: a crawler forbidden to *fetch* a URL never reads the
 `noindex` on it. `/legal/privacy/` and `/legal/terms/` are linked from the