fix: sweep D3 amendment through the specs; correct inverted DKIM table

The re-audit of the deploy-guard change surfaced defects well outside the
diff, including one that would have broken production mail.

docs/05-backend-spec.md had the two SES DKIM sets exactly inverted, labelling
the three records that resolve as "orphans" and the three NXDOMAIN records as
"Live. Never delete". Entry (j) corrected this in AGENTS.md §7 and the
correction never reached docs/05. Since SES has no custom MAIL FROM, DKIM is
the only thing satisfying DMARC, so acting on that table would have silently
broken intake mail authentication.

Also in this change:

- .gitea/workflows/deploy.yml gains a guard as steps[0] that fails the run,
  naming the variable, if AWS_REGION, S3_BUCKET or CLOUDFRONT_DISTRIBUTION_ID
  is empty — how a Gitea too old for the vars context manifests. Verified
  fail-closed under bash -e, sh -e and bash -euo pipefail.
- AGENTS.md Current Truth: SPF and DMARC recorded as present (Q20), the
  matching §10 High risk row retired, three duplicate Q rows removed.
- docs/reference/AWS-Hosting-Guide.md tracked and given a do-not-execute
  banner; it was an executable procedure for the architecture D1/D3 replace.
- Copy decks: "a working litigator" and "an active litigation practice"
  replaced with the register's own wording; LegalService JSON-LD replaced with
  ProfessionalService; tribunal-secretary offers removed per D14; nine stale
  question blockers swept.
- astro.config.mjs: prefetchAll disabled — it injected JS into every page
  against the zero-JS convention with no decision recorded.
- src/data/site.ts: unregistered response-time commitment nulled (Q27);
  OBA section names downgraded to [assumed] (Q28).
- s3:AbortMultipartUpload reasoning corrected to measure ./dist, not the repo.

Opens Q27, Q28, Q29. AGENTS.md entry (q) records the full resolution,
including the findings declined and why.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012XquaEq4BgWMCwUqLEyNkF

CLAUDE.md

@@ -22,9 +22,14 @@
 
 ## The one rule that matters more than the code
 
-Pouya is a licensed legal professional. **No factual claim about him, his
-credentials, his experience, or his practice may appear on a public page unless
-it is in the Verified table in `AGENTS.md` §4.**
+This is Pouya's public marketing surface, and the site it replaces carried
+fabricated credentials. **No factual claim about him, his credentials, his
+experience, or his practice may appear on a public page unless it is in the
+Verified table in `AGENTS.md` §4.**
+
+(§4 does not verify licensure either way — so do not describe him as
+"licensed", or as a "legal professional", anywhere, this file included. State
+the reason for the rule, not a credential the register cannot vouch for.)
 
 If a page needs a fact you do not have:
 
@@ -78,10 +83,12 @@ view from the artefact — that independence *is* the mechanism.
 
 **The reviewers are instructed to treat uncertainty as a defect.** They will
 sometimes be wrong, and that is the intended trade. Explaining why a finding is
-mistaken costs minutes; a missed defect on a licensed professional's public
-marketing page costs considerably more. Do not read a finding as an accusation,
-and do not argue a reviewer down — either fix it, or record the reason you
-declined it so a later reader can see the judgement was made rather than missed.
+mistaken costs minutes; a missed defect on this project's public marketing
+pages costs considerably more — the site this replaces carried fabricated
+credentials, and that is the standard being corrected. Do not read a finding as
+an accusation, and do not argue a reviewer down — either fix it, or record the
+reason you declined it so a later reader can see the judgement was made rather
+than missed.
 
 **Two reviewers, because they catch different things.** `adversarial-reviewer`
 reads the code. `claims-auditor` reads the copy against the §4 register and knows
@@ -97,7 +104,9 @@ npm run dev        # local dev server
 npm run build      # static build to ./dist
 npm run preview    # serve ./dist locally
 npm run check      # astro check — type and template errors
-npm run lint       # eslint + prettier check
+npm run lint       # eslint + prettier check — NOT YET WIRED, no eslint config
+npm run format     # prettier — rewrite files in place
+npm run lighthouse # lighthouse CI — NOT YET WIRED, no lighthouserc
 ```
 
 ## Where things live
@@ -110,7 +119,7 @@ docs/                  the specs you build from
   03-content-spec.md   voice, copy rules, per-page copy deck
   04-seo-spec.md       metadata, structured data, sitemap, crawlability
   05-backend-spec.md   intake form, Lambda/DynamoDB/SES, booking, PIPEDA
-  06-deployment.md     S3/CloudFront, GitHub Actions OIDC, cutover checklist
+  06-deployment.md     S3/CloudFront, Gitea Actions, IAM, cutover checklist
 src/
   styles/tokens.css    design tokens — the single source of colour and scale
   styles/global.css    reset, base type, utilities
@@ -153,9 +162,20 @@ page that collects legal inquiries.
 URL, Open Graph and Twitter card tags, and appropriate JSON-LD. See
 `docs/04-seo-spec.md`. A page without these is not finished.
 
+**A sweep is a command, not a claim.** Any statement that a change was applied
+across files — a phrase removed everywhere, a path updated everywhere, a
+decision swept through the docs — must cite the command that proves it, and be
+written only after reading that command's output. Paste the `grep` into the
+Change Log entry. Three consecutive entries on this project asserted a completed
+sweep; instances survived all three, and one of them was inside
+`.claude/agents/claims-auditor.md` — the definition of the agent whose job is to
+catch exactly that. Recall is not evidence.
+
 **Commits.** Conventional Commits (`feat:`, `fix:`, `docs:`, `chore:`, `refactor:`).
 One logical change per commit. Never commit secrets, `.env` files, or AWS
-credentials — deploys use OIDC role assumption.
+credentials. Gitea is not an AWS OIDC provider, so the deploy key is designed as
+a static IAM access key to be held in Gitea Actions secrets — whether it has
+actually been provisioned is `AGENTS.md` Q22. It must never reach the repo.
 
 **Performance budget.** Lighthouse ≥ 95 on all four categories, on mobile, for
 every page. Under 100 KB of JS on any route. LCP under 2.0 s on a simulated