mirror rev 4: evidence-verified rewrite, six-diagram artefact set, front-end and build-gate hardening

Content corrected against upstream docs, deployed-version source and the live
config: retention/GC semantics (untagged manifests including digest-only
pull-through entries are GC-eligible; keepUntagged is v2.1.19+, not deployed),
warm-cache guarantees (tag pulls revalidate upstream per open issue; digest
pulls serve locally), retry arithmetic (buildah --retry counts retries: 16 max,
not 12), five-upstream flat-namespace routing stated as observed risk with a
proposed prefix redesign, auth-canary design validated against longest-match
policy precedence with the Docker-client caveat, coalescing reframed from
deadlock to design with the restart as recovery-not-root-cause. Adds fact
panel, contents, failure-mode and cache test matrices, decision table, open
verification register and primary-source references. Front-end: grid full-bleed
(no viewport units - no scrollbar overflow), shell-level skip link, real
1600x872 intrinsic dims injected from bytes, lazy below-fold plates, AA
code-comment contrast, scene engine rewritten (IO-gated, rAF-coalesced, live
reduced-motion, hidden-tab pause, zero guards). Assembler: per-page gates plus
mirror-specific required/banned content assertions. README describes the
multi-page site honestly.

pilot/index.tpl.html

@@ -34,9 +34,6 @@ h1 em{color:var(--cyan);font-style:normal}
 footer{border-top:1px solid var(--line);padding:1.4rem 0 3rem;color:var(--dim);
   font-family:var(--mono);font-size:.82rem}
 footer a{color:var(--cyan)}
-a.skip{position:absolute;left:-9999px}
-a.skip:focus{left:1rem;top:1rem;background:var(--void);color:var(--cyan);
-  font-family:var(--mono);font-size:.8rem;padding:10px 16px;border:1px solid var(--cyan);border-radius:6px}
 :focus-visible{outline:2px solid var(--cyan);outline-offset:2px}
 @media (max-width:640px){.card{grid-template-columns:1fr}.card .thumb{max-height:170px}}
 </style>