feat: upgrade to Astro 7; harden the content schema; wire a11y linting

Amends D1 to pin the major explicitly (v7.x) rather than inherit it. The
^5.0.0 pin was recalled rather than checked and was two majors stale the day
it was written, which meant shipping a framework carrying high-severity XSS
advisories. CLAUDE.md now requires every version pin to be verified against
the registry, and R11 requires re-checking at each build-order boundary.

npm audit now reports 0 vulnerabilities, down from 16. Every Astro advisory
is cleared; the residual 10 all traced to @lhci/cli, which is removed — it
was the sole source of 7 high-severity findings, 0.15.1 is latest so there
was no clean upgrade, and it cannot run without pages or a lighthouserc.
Re-added at build step 7 with a freshly verified pin.

Content collections migrated to the Content Layer API: src/content.config.ts,
loader: glob(), z from astro/zod.

Two review passes found seven defects in the fix itself, all now closed:

- z.coerce.date() read an unquoted 20260801 as epoch milliseconds and
  yielded 1970-01-01 silently; the first replacement then accepted
  2026-13-45 as an Invalid Date and rolled 2026-02-30 over to 2026-03-02.
  Dates are now anchored, date-only, parsed as UTC and round-tripped.
- The title bound applied the SEO spec's 50-60 to the headline rather than
  the rendered <title>, which guaranteed 68-78 on every article and rejected
  all five planned launch headlines. Articles are now the documented
  exception: the headline is the <title>, no suffix.
- An article could ship an image with no alt text, or whitespace-only alt.
- Two schema comments asserted controls nothing enforced; both are now real
  refinements, each tested with a failing and a passing case.
- PRACTICE_SLUGS and PRACTICE_AREAS could drift silently; a compile-time
  check now catches both directions.
- eslint.config.js imported globals and @eslint/js undeclared, resolving by
  hoisting accident.
- scripts/deploy-local.sh claimed parity with CI while skipping npm run
  check and two credential guards — on the only path this site can ship
  today.

Accessibility linting is on (36 jsx-a11y rules) before step 1 writes the
layout. An earlier claim in §7 that none was possible was wrong twice, and
is corrected in AGENTS.md entry (t) along with the reasoning.

Opens Q30 and Q31 for two unregistered claims in src/data/site.ts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012XquaEq4BgWMCwUqLEyNkF

src/data/site.ts

@@ -11,7 +11,13 @@ export const SITE = {
   tagline: 'Mediation · Arbitration · Toronto',
   url: 'https://adr.smlcompany.ca',
   locale: 'en_CA',
-  entity: 'SML Company Ltd. · Ontario, Canada',
+  /**
+   * TODO(pouya): AGENTS.md Q30 — §4 verifies "Operator of SML Company Ltd."
+   * but nothing verifies the company's jurisdiction of incorporation, and this
+   * string is destined for the public footer. Jurisdiction dropped until
+   * confirmed; the operator fact itself is verified and stays.
+   */
+  entity: 'SML Company Ltd.',
 } as const;
 
 /**
@@ -58,7 +64,12 @@ export const BOUTIQUE = 'a Toronto litigation and ADR boutique' as const;
 
 /** Analytics: privacy-first and cookieless (D15). No GA4, no consent banner. */
 export const ANALYTICS = {
-  provider: 'plausible' as 'plausible' | 'fathom' | null,
+  /**
+   * TODO(pouya): AGENTS.md Q31 — D15 records the choice as "Plausible **or**
+   * Fathom", i.e. undecided. `'plausible'` was a guessed value, which is what
+   * the header of this file tells you not to do. Null until you pick one.
+   */
+  provider: null as 'plausible' | 'fathom' | null,
   domain: 'adr.smlcompany.ca',
 } as const;
 
@@ -92,7 +103,8 @@ export const PORTRAIT = {
 /** Shown on /contact/ and with the booking embed. Do not reword casually. */
 export const NO_RETAINER_NOTICE =
   'Submitting this form does not create a retainer, does not appoint a neutral, ' +
-  'and does not itself establish a mediator–party relationship.';
+  'does not itself establish a mediator–party relationship, and does not itself ' +
+  'create a conflict check.';
 
 /**
  * Rate card — AGENTS.md D14, confirmed by Pouya 2026-08-26.
@@ -136,6 +148,22 @@ export const FEES = {
   ],
 } as const;
 
+/**
+ * Slugs as their own literal tuple so consumers keep the union type.
+ * Deriving them with `.map()` and casting to `[string, ...string[]]` widens
+ * them back to `string`, and a mistyped slug then survives `astro check`.
+ */
+export const PRACTICE_SLUGS = [
+  'construction',
+  'technology',
+  'energy',
+  'insurance',
+  'shareholder',
+  'cross-cultural',
+] as const;
+
+export type PracticeSlug = (typeof PRACTICE_SLUGS)[number];
+
 export const PRACTICE_AREAS = [
   {
     slug: 'construction',
@@ -155,7 +183,30 @@ export const PRACTICE_AREAS = [
     name: 'Cross-Border & Diaspora',
     chip: 'Cross-cultural',
   },
-] as const;
+] as const satisfies ReadonlyArray<{
+  slug: PracticeSlug;
+  name: string;
+  chip: string;
+}>;
+
+/**
+ * Compile-time completeness check, both directions.
+ *
+ * `satisfies` above catches a slug in PRACTICE_AREAS that is not in
+ * PRACTICE_SLUGS. This catches the reverse — a slug with no area — which would
+ * otherwise let an article declare a practice area that has no page, no nav
+ * child and no chip, producing a dead link at step 7. Deriving the areas from
+ * the slugs used to make that structurally impossible; keeping two literals is
+ * what buys the literal types back, so the check has to be explicit.
+ *
+ * Type-only. Nothing runs, nothing ships.
+ */
+type _AssertNever<T extends never> = T;
+type _SlugsWithoutAnArea = Exclude<
+  PracticeSlug,
+  (typeof PRACTICE_AREAS)[number]['slug']
+>;
+export type _SlugCoverage = _AssertNever<_SlugsWithoutAnArea>;
 
 /** Seven items is the ceiling before a nav stops being scannable. */
 export const PRIMARY_NAV = [