feat: build step 5 — /practice/ and six area pages; check:claims gates §4 in dist

Step 5 ships /practice/ and the six practice-area pages (construction,
technology, energy, insurance, shareholder, cross-border) from one route, and
adds the mechanical §4 gate Pouya ruled for.

check:claims — §4 Forbidden becomes a build error
  scripts/check-claims.mjs greps dist/**/*.html for 10 patterns, each carrying
  the incident that put it there. It strips <style> and non-JSON-LD <script>
  first (a bare sweep for "leading" returned 26 hits, 25 of them
  var(--leading-body)), self-tests every pattern against fixtures before
  sweeping, and refuses a missing, empty or stale dist/. Wired into /build
  Phase 5 and both deploy paths.

Q54 — six conduct undertakings publish, and §4 gains a third class
  Conduct undertakings sit apart from credentials and offerings: the gate is
  that Pouya said it in terms. The strings live in CONDUCT_UNDERTAKINGS so a
  softening is one visible diff. (e) and (f) replace the third-person sentences
  already on /arbitration/ rather than joining them.

Q49, Q50 recorded as rulings. §7 records the SES us-east-1 stray identity's
deletion. R11 holds typescript at its current major, with the peer-range
reason recorded.

Three facts corrected, two of them already shipped
  - The LAT gloss said mediation "before filing and continuing after filing";
    the Tribunal names mediation for "Before you apply" only and its second
    sentence is about negotiation. An ellipsis in docs/01 had deleted it.
  - "Connection allocation" is not an Ontario term.
  - "The 2026 privacy statute" does not exist — Bill C-27 died without royal
    assent. Struck from docs/03 rather than corrected in place.

ADR Chambers struck from /arbitration/ and from docs/01 item 3 (Pouya,
2026-08-30): the source establishes what the firm publishes, not that an
outside neutral can be appointed under its rules.

claims-auditor gains a second lens — for every quoted source, whether the
sentence beneath stays inside what the quotation establishes. Four shipped
defects had that shape and none of them is greppable.

CLAUDE.md gains a convention: never truncate the output of a check you intend
to believe. `npm run check | tail -3` returns warnings, hints and a blank line
and drops the errors line; it was reported as passing four times while
astro check was exiting 1 with 10 type errors.

Gates, exit status read directly, not through a pipe:
  npm run check        exit=0
  npm run lint         exit=0
  npm run build        exit=0
  npm run check:claims exit=0

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

scripts/deploy-local.sh

@@ -8,9 +8,10 @@
 # ships.
 #
 # It matches .gitea/workflows/deploy.yml on everything that determines what gets
-# published: the same guard coverage, `npm run check` before the build, the same
-# three sync passes in the same order with the same cache headers, and the same
-# invalidation. Any change to one must be made to the other.
+# published: the same guard coverage, `npm run check` before the build,
+# `npm run check:claims` after it, the same three sync passes in the same order
+# with the same cache headers, and the same invalidation. Any change to one must
+# be made to the other.
 #
 # Two deliberate differences: it does not run `npm ci` (your node_modules is
 # already installed, and CI starts empty), and it refuses to run as user/pouya,
@@ -66,6 +67,14 @@ PUBLIC_INTAKE_ENDPOINT="$INTAKE_ENDPOINT" \
 PUBLIC_BOOKING_URL="${BOOKING_URL:-}" \
   npm run build
 
+# AFTER the build and BEFORE anything is uploaded. AGENTS.md §4 Forbidden,
+# enforced mechanically on the output rather than by a reviewer reading it.
+# Pouya's ruling 2026-08-29: "prose in a comment does not govern the writing
+# that follows it." It also refuses to run against a stale or empty dist, so a
+# pass here is a pass on the bytes about to be published.
+echo "==> Claim check"
+npm run check:claims
+
 echo "==> Pass 1/3 — hashed assets and fonts (immutable)"
 aws s3 sync ./dist "s3://${S3_BUCKET}" \
   --exclude "*" \