feat: build step 5 — /practice/ and six area pages; check:claims gates §4 in dist

Step 5 ships /practice/ and the six practice-area pages (construction,
technology, energy, insurance, shareholder, cross-border) from one route, and
adds the mechanical §4 gate Pouya ruled for.

check:claims — §4 Forbidden becomes a build error
  scripts/check-claims.mjs greps dist/**/*.html for 10 patterns, each carrying
  the incident that put it there. It strips <style> and non-JSON-LD <script>
  first (a bare sweep for "leading" returned 26 hits, 25 of them
  var(--leading-body)), self-tests every pattern against fixtures before
  sweeping, and refuses a missing, empty or stale dist/. Wired into /build
  Phase 5 and both deploy paths.

Q54 — six conduct undertakings publish, and §4 gains a third class
  Conduct undertakings sit apart from credentials and offerings: the gate is
  that Pouya said it in terms. The strings live in CONDUCT_UNDERTAKINGS so a
  softening is one visible diff. (e) and (f) replace the third-person sentences
  already on /arbitration/ rather than joining them.

Q49, Q50 recorded as rulings. §7 records the SES us-east-1 stray identity's
deletion. R11 holds typescript at its current major, with the peer-range
reason recorded.

Three facts corrected, two of them already shipped
  - The LAT gloss said mediation "before filing and continuing after filing";
    the Tribunal names mediation for "Before you apply" only and its second
    sentence is about negotiation. An ellipsis in docs/01 had deleted it.
  - "Connection allocation" is not an Ontario term.
  - "The 2026 privacy statute" does not exist — Bill C-27 died without royal
    assent. Struck from docs/03 rather than corrected in place.

ADR Chambers struck from /arbitration/ and from docs/01 item 3 (Pouya,
2026-08-30): the source establishes what the firm publishes, not that an
outside neutral can be appointed under its rules.

claims-auditor gains a second lens — for every quoted source, whether the
sentence beneath stays inside what the quotation establishes. Four shipped
defects had that shape and none of them is greppable.

CLAUDE.md gains a convention: never truncate the output of a check you intend
to believe. `npm run check | tail -3` returns warnings, hints and a blank line
and drops the errors line; it was reported as passing four times while
astro check was exiting 1 with 10 type errors.

Gates, exit status read directly, not through a pipe:
  npm run check        exit=0
  npm run lint         exit=0
  npm run build        exit=0
  npm run check:claims exit=0

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

.gitea/workflows/deploy.yml

@@ -102,6 +102,14 @@ jobs:
           PUBLIC_INTAKE_ENDPOINT: ${{ vars.INTAKE_ENDPOINT }}
           PUBLIC_BOOKING_URL: ${{ vars.BOOKING_URL }}
 
+      # AGENTS.md §4 Forbidden, enforced on the built output before a single
+      # byte is uploaded. Runs here rather than in `npm run check` because it
+      # reads dist/, and it refuses a stale or empty dist for the same reason
+      # this workflow guards its variables: an empty sweep reads exactly like a
+      # clean one. Mirrored in scripts/deploy-local.sh.
+      - name: Claim check
+        run: npm run check:claims
+
       # Some Gitea runner images ship without the AWS CLI. Install if missing.
       - name: Ensure AWS CLI
         run: |