feat: build step 5 — /practice/ and six area pages; check:claims gates §4 in dist

Step 5 ships /practice/ and the six practice-area pages (construction,
technology, energy, insurance, shareholder, cross-border) from one route, and
adds the mechanical §4 gate Pouya ruled for.

check:claims — §4 Forbidden becomes a build error
  scripts/check-claims.mjs greps dist/**/*.html for 10 patterns, each carrying
  the incident that put it there. It strips <style> and non-JSON-LD <script>
  first (a bare sweep for "leading" returned 26 hits, 25 of them
  var(--leading-body)), self-tests every pattern against fixtures before
  sweeping, and refuses a missing, empty or stale dist/. Wired into /build
  Phase 5 and both deploy paths.

Q54 — six conduct undertakings publish, and §4 gains a third class
  Conduct undertakings sit apart from credentials and offerings: the gate is
  that Pouya said it in terms. The strings live in CONDUCT_UNDERTAKINGS so a
  softening is one visible diff. (e) and (f) replace the third-person sentences
  already on /arbitration/ rather than joining them.

Q49, Q50 recorded as rulings. §7 records the SES us-east-1 stray identity's
deletion. R11 holds typescript at its current major, with the peer-range
reason recorded.

Three facts corrected, two of them already shipped
  - The LAT gloss said mediation "before filing and continuing after filing";
    the Tribunal names mediation for "Before you apply" only and its second
    sentence is about negotiation. An ellipsis in docs/01 had deleted it.
  - "Connection allocation" is not an Ontario term.
  - "The 2026 privacy statute" does not exist — Bill C-27 died without royal
    assent. Struck from docs/03 rather than corrected in place.

ADR Chambers struck from /arbitration/ and from docs/01 item 3 (Pouya,
2026-08-30): the source establishes what the firm publishes, not that an
outside neutral can be appointed under its rules.

claims-auditor gains a second lens — for every quoted source, whether the
sentence beneath stays inside what the quotation establishes. Four shipped
defects had that shape and none of them is greppable.

CLAUDE.md gains a convention: never truncate the output of a check you intend
to believe. `npm run check | tail -3` returns warnings, hints and a blank line
and drops the errors line; it was reported as passing four times while
astro check was exiting 1 with 10 type errors.

Gates, exit status read directly, not through a pipe:
  npm run check        exit=0
  npm run lint         exit=0
  npm run build        exit=0
  npm run check:claims exit=0

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

docs/03-content-spec.md

@@ -295,8 +295,38 @@ Meeting the strongest objection is what makes the page worth reading.
 ### Practice areas
 Each page: dispute types, why this practice fits, what the process looks like,
 and the market context that makes the area live. Context comes from the strategy
-brief §III–IV — Ontario's megaproject pipeline, Bill 40 and grid connection, the
-2026 privacy statute, LAT volumes.
+brief §III–IV — Ontario's megaproject pipeline, Bill 40 and grid connection,
+~~the 2026 privacy statute~~, LAT volumes.
+
+> ⚠️ **"THE 2026 PRIVACY STATUTE" DOES NOT EXIST. Struck rather than corrected
+> in place, so the phrase is not re-invented. Checked 2026-08-29; sourced in
+> `docs/reference/canada-privacy-technology.md`.**
+>
+> **Nothing enacted federally or in Ontario in 2025 or 2026 is a privacy
+> statute.** Bill C-27 — which would have enacted the Consumer Privacy
+> Protection Act and the Artificial Intelligence and Data Act — **died without
+> royal assent** when the 44th Parliament's first session ended, and was never
+> reinstated. **PIPEDA remains the operative federal private-sector statute**,
+> and **Canada has no federal AI statute.** The nearest real thing is federal
+> **Bill C-36 (45-1)**, introduced 15 June 2026, which *would* enact the
+> Protecting Privacy and Consumer Data Act — a bill, at second reading, not law.
+>
+> **Caught before it reached a page, and only because the phrase was checked
+> rather than trusted.** Same failure mode as `docs/01`'s "Model Mediation
+> Rules" and the LAT gloss corrected the same day: a spec naming an instrument
+> from recall, and an implementer with no reason to doubt it. **Bill 40 in the
+> same sentence turned out to be real** — Bill 40 of the 44th Parliament, 1st
+> Session, the *Protect Ontario by Securing Affordable Energy for Generations
+> Act, 2025* — but the number alone did not establish that, because bill numbers
+> are reused every parliament. Cite the parliament and session.
+>
+> **What `/practice/technology/` publishes instead** is the real position, and
+> it is better copy than the invented one: what is in force, what died, what is
+> only a bill — and the genuinely useful part for a commercial audience, that
+> **no Canadian statute requires personal data to be stored in Canada.** That is
+> the assumption a great many data-residency clauses are drafted against, and it
+> is quoted from the Privacy Commissioner's own guidance rather than concluded
+> here.
 
 **Frame as positioning, not as history.** "Built to facilitate procurement and
 subcontract disputes on Ontario's megaproject pipeline" — not "extensive