docs: reconcile content federation authority

[Jesssullivan]

Summary

• add a dated evidence hierarchy, completion vocabulary, authority map, and contradiction ledger for the blog, Tinyland content, Pulse, ActivityPub, package releases, Linear, prompts, branches, and worktrees
• record live route results and current PR/ticket dispositions without collapsing source, release, adoption, deploy, runtime mutation, or end-to-end proof
• correct the deployment diagram so Cloudflare Pages is production and GitHub Pages is rollback
• document that the prerendered WebFinger endpoint ignores resource, is not RFC 7033-compliant discovery, and remains tracked by TIN-2880

Claim boundary

This PR does not enable ActivityPub delivery, change broker behavior, adopt package releases, bootstrap a user, rotate or install keys, change secrets, mutate Linear state, or touch live infrastructure. GitHub Projects v2 remains uninspected because the existing keychain credential lacks read:project; PR, issue, branch, workflow, Linear, package, source, and live-route evidence are recorded separately.

Validation

• npx vitest run src/routes/.well-known/webfinger/webfinger.test.ts
• npm run lint
• npm run build
• npm run test:production-health
• git diff --check main...HEAD

An earlier full production-health run passed DNS, HTTPS, canonical redirects, broker contracts, and public blog hydration. The post-rebase rerun passed the DNS, HTTPS, redirect, representative-post, and 140-post broker phases, then the local macOS Chrome process failed to complete Playwright launch within 180 seconds before any site assertion ran. Hosted PR CI remains the browser authority. The build completed with the repository existing content-link/prerender warnings; generated image/stat artifacts were not committed.

[Jesssullivan]

Additional local validation: npm run build passed on commit 5526d42 (140-post generated search index, static adapter output, Pagefind index, and directory aliases). The build reported three pre-existing accessibility warnings in the CV and Pulse demo surfaces; this PR does not touch those files. Build-generated artifact changes were cleaned and are not part of the branch.

[Jesssullivan]

Follow-on execution found a concrete example of the reconciliation problem: this repo was declared shared-cache-backed in the GF registry but its CI workflow claimed executor-backed authority, so PR refs deterministically failed token mint before tests. #228 is the consolidated repair and must land before this documentation PR can get a genuine Bazel green. The generated search index was also rechecked: it is ignored build output, not a committed stale fixture; the audit text already records that correction.