fix: sweep D3 amendment through the specs; correct inverted DKIM table

The re-audit of the deploy-guard change surfaced defects well outside the
diff, including one that would have broken production mail.

docs/05-backend-spec.md had the two SES DKIM sets exactly inverted, labelling
the three records that resolve as "orphans" and the three NXDOMAIN records as
"Live. Never delete". Entry (j) corrected this in AGENTS.md §7 and the
correction never reached docs/05. Since SES has no custom MAIL FROM, DKIM is
the only thing satisfying DMARC, so acting on that table would have silently
broken intake mail authentication.

Also in this change:

- .gitea/workflows/deploy.yml gains a guard as steps[0] that fails the run,
  naming the variable, if AWS_REGION, S3_BUCKET or CLOUDFRONT_DISTRIBUTION_ID
  is empty — how a Gitea too old for the vars context manifests. Verified
  fail-closed under bash -e, sh -e and bash -euo pipefail.
- AGENTS.md Current Truth: SPF and DMARC recorded as present (Q20), the
  matching §10 High risk row retired, three duplicate Q rows removed.
- docs/reference/AWS-Hosting-Guide.md tracked and given a do-not-execute
  banner; it was an executable procedure for the architecture D1/D3 replace.
- Copy decks: "a working litigator" and "an active litigation practice"
  replaced with the register's own wording; LegalService JSON-LD replaced with
  ProfessionalService; tribunal-secretary offers removed per D14; nine stale
  question blockers swept.
- astro.config.mjs: prefetchAll disabled — it injected JS into every page
  against the zero-JS convention with no decision recorded.
- src/data/site.ts: unregistered response-time commitment nulled (Q27);
  OBA section names downgraded to [assumed] (Q28).
- s3:AbortMultipartUpload reasoning corrected to measure ./dist, not the repo.

Opens Q27, Q28, Q29. AGENTS.md entry (q) records the full resolution,
including the findings declined and why.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012XquaEq4BgWMCwUqLEyNkF

.gitea/workflows/deploy.yml

@@ -1,14 +1,18 @@
 # Gitea Actions — the live pipeline for this repository.
 #
 # Gitea Actions speaks GitHub Actions syntax, so this is a near-direct port of
-# .github/workflows/deploy.yml (kept as the OIDC reference in case the repo ever
-# moves to GitHub or GitLab).
+# docs/reference/github-actions-oidc.yml.example (kept as the OIDC reference in
+# case the repo ever moves to GitHub; it lives under docs/ rather than
+# .github/workflows/ so Gitea can never fall back to it).
 #
 # ONE REAL DIFFERENCE: Gitea is not an AWS OIDC provider, so there is no role to
-# assume. Deploys authenticate with a SCOPED IAM USER whose key lives only in
-# this repository's Gitea secrets. See docs/06-deployment.md for the exact IAM
-# policy — it grants four actions on one bucket and one distribution, nothing
-# more. Rotate the key quarterly; OIDC would have made that unnecessary.
+# assume. Deploys are designed to authenticate with a SCOPED IAM USER whose key
+# lives only in this repository's Gitea secrets. Whether that user and key have
+# actually been created is AGENTS.md Q22 — unanswered as of 2026-08-26.
+#
+# See docs/06-deployment.md for the exact IAM policy — it grants four actions on
+# one bucket and one distribution, nothing more. Rotate the key quarterly; OIDC
+# would have made that unnecessary.
 #
 # Requires a Gitea Actions runner registered to this repo or its organisation.
 
@@ -35,6 +39,36 @@ jobs:
       CLOUDFRONT_DISTRIBUTION_ID: ${{ vars.CLOUDFRONT_DISTRIBUTION_ID }}
 
     steps:
+      # Runs first, before checkout and before any AWS call, so a
+      # misconfiguration costs one second instead of a full build.
+      #
+      # Repository variables live at Settings -> Actions -> Variables. Gitea
+      # only added the `vars` context in 1.21 [assumed 2026-08-26 - not checked
+      # against this instance]; on an older one every ${{ vars.* }} is expected
+      # to interpolate to an empty string, the sync target below degrades to
+      # "s3://", and the run dies obscurely somewhere in the middle.
+      #
+      # SCOPE: this guard covers the three DEPLOY-TARGET variables only. It does
+      # NOT cover AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (an unset secret
+      # still fails later, at `aws sts get-caller-identity`), nor
+      # vars.INTAKE_ENDPOINT, which is step-scoped on the Build step and whose
+      # absence would ship a form posting to an empty endpoint. See AGENTS.md
+      # Q23 - extending the guard to both is an open decision, not an oversight.
+      - name: Guard - required repository variables are set
+        run: |
+          missing=''
+          [ -n "$AWS_DEFAULT_REGION" ] || missing="$missing AWS_REGION"
+          [ -n "$S3_BUCKET" ] || missing="$missing S3_BUCKET"
+          [ -n "$CLOUDFRONT_DISTRIBUTION_ID" ] || missing="$missing CLOUDFRONT_DISTRIBUTION_ID"
+          if [ -n "$missing" ]; then
+            echo "Missing repository variables:$missing"
+            echo
+            echo 'Set them at Settings -> Actions -> Variables (see docs/06-deployment.md).'
+            echo 'If they ARE set, this Gitea instance predates the vars context (1.21+).'
+            exit 1
+          fi
+          echo 'Required repository variables are present.'
+
       - uses: actions/checkout@v4
 
       - uses: actions/setup-node@v4
@@ -68,8 +102,8 @@ jobs:
       - name: Verify credentials
         run: aws sts get-caller-identity
 
-      # Two passes: hashed immutable assets first, HTML last. A visitor must
-      # never fetch a new page whose assets have not landed yet.
+      # Three passes: hashed immutable assets first, then images, HTML last.
+      # A visitor must never fetch a new page whose assets have not landed yet.
       - name: Sync hashed assets
         run: |
           aws s3 sync ./dist "s3://${S3_BUCKET}" \