fix: sweep D3 amendment through the specs; correct inverted DKIM table

The re-audit of the deploy-guard change surfaced defects well outside the
diff, including one that would have broken production mail.

docs/05-backend-spec.md had the two SES DKIM sets exactly inverted, labelling
the three records that resolve as "orphans" and the three NXDOMAIN records as
"Live. Never delete". Entry (j) corrected this in AGENTS.md §7 and the
correction never reached docs/05. Since SES has no custom MAIL FROM, DKIM is
the only thing satisfying DMARC, so acting on that table would have silently
broken intake mail authentication.

Also in this change:

- .gitea/workflows/deploy.yml gains a guard as steps[0] that fails the run,
  naming the variable, if AWS_REGION, S3_BUCKET or CLOUDFRONT_DISTRIBUTION_ID
  is empty — how a Gitea too old for the vars context manifests. Verified
  fail-closed under bash -e, sh -e and bash -euo pipefail.
- AGENTS.md Current Truth: SPF and DMARC recorded as present (Q20), the
  matching §10 High risk row retired, three duplicate Q rows removed.
- docs/reference/AWS-Hosting-Guide.md tracked and given a do-not-execute
  banner; it was an executable procedure for the architecture D1/D3 replace.
- Copy decks: "a working litigator" and "an active litigation practice"
  replaced with the register's own wording; LegalService JSON-LD replaced with
  ProfessionalService; tribunal-secretary offers removed per D14; nine stale
  question blockers swept.
- astro.config.mjs: prefetchAll disabled — it injected JS into every page
  against the zero-JS convention with no decision recorded.
- src/data/site.ts: unregistered response-time commitment nulled (Q27);
  OBA section names downgraded to [assumed] (Q28).
- s3:AbortMultipartUpload reasoning corrected to measure ./dist, not the repo.

Opens Q27, Q28, Q29. AGENTS.md entry (q) records the full resolution,
including the findings declined and why.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012XquaEq4BgWMCwUqLEyNkF

docs/01-architecture.md

@@ -170,14 +170,14 @@ neutral.
 **Search intent:** `sole arbitrator Ontario`, `expedited arbitration Canada`,
 `documents-only arbitration`.
 
-1. What the service is; sole-arbitrator, party-appointed, and tribunal-secretary
+1. What the service is; sole-arbitrator and party-appointed
    appointments.
 2. **Tracks:** documents-only, expedited, full hearing.
 3. **Rules:** ADRIC, ADR Chambers, ad hoc.
 4. Awards — form, reasoning, timing.
 5. **Credentialing status, stated plainly.** The Q.Arb pathway is in progress;
    the page says so and describes what is available now (co-arbitration,
-   tribunal secretary) versus what follows designation. Honesty here is a
+   co-arbitration) versus what follows designation. Honesty here is a
    differentiator, not a weakness — and misstating it is a conduct problem.
 6. Fees, booking.
 
@@ -208,7 +208,7 @@ system design, and pre-dispute technical advisory.
 `subcontract dispute arbitration Toronto`.
 
 Dispute types (lien, delay, change orders, scheduling, subcontract, deficiency);
-what an active litigation practice in the same matters brings to the room; the
+what active litigation exposure in the same matters brings to the room; the
 Ontario megaproject pipeline as context — Darlington SMR, Bruce C, data centres,
 transit; typical process shape. Strongest immediate fit per brief §III.1.
 
@@ -243,7 +243,7 @@ a claim of existing volume.**
 `accident benefits mediator Ontario`, `MIG dispute`.
 
 Highest realistic near-term volume — it flows directly from the existing
-personal-injury and SABS practice, and brief §IV.7 notes the segment is
+personal-injury and SABS work, and brief §IV.7 notes the segment is
 underserved by senior mediators. Unglamorous and worth doing well.
 
 ### `/practice/shareholder/`
@@ -274,7 +274,8 @@ a matter does not settle.
 
 ### `/fees/`
 
-**Blocked on `AGENTS.md` Q4 — do not invent numbers.**
+**Unblocked — `AGENTS.md` Q4/Q14 answered (D14). Build from the confirmed card
+in `docs/07-fees.md`; still do not invent numbers.**
 
 Hourly rate; half-day and full-day mediation; preparation time policy;
 cancellation terms; administrative fee; HST treatment; who pays and how costs
@@ -339,6 +340,6 @@ Dependency-ordered, so nothing is blocked mid-stream:
 6. `/process/`, `/for-parties/`
 7. `/insights/` plumbing, then the drafted articles
 8. `/contact/` and the intake backend
-9. `/fees/` — last, since it is blocked on Q4
+9. `/fees/` — last, though no longer blocked: D14 confirmed the card
 10. `/legal/*` — written to match the backend as actually built
 11. Audit and cutover (`06-deployment.md`)