feat(seo): add machine-readable companion experiments

[JorgeMenaDev]

Outcome

Add a bounded, provider-independent contract for machine-readable companion surfaces inside ordinary AI-search visibility work.

Source and evidence

Prompted by Marc Lou's TrustMRR experiment:

• https://x.com/marclou/status/2075598949277421891
• https://x.com/marclou/status/2076687096279171344

Direct inspection on 2026-07-13 found:

• https://trustmrr.com/startup/datafast.md returned 200 as inline text/plain and exposed a public, self-contained startup profile.
• https://trustmrr.com/llms.txt and the limited read-only https://trustmrr.com/api/ai were live.
• TrustMRR's sitemap index contained 8,307 .md URLs at inspection time, including datafast.md.
• The post showed route-family bot observations and a later successful manual ChatGPT fetch, but did not isolate whether headers, sitemap discovery, elapsed time, or cache state caused that result.
• Bot requests did not prove search indexation, training use, citations, referrals, or revenue.

What changes

• Adds an optional machine-readable companion experiment to ai-search-visibility.md.
• Requires canonical HTML and an observed access gap before adoption.
• Keeps HTML/Markdown/llms.txt/API representations on one source of truth.
• Defines public-data, canonical, response, privacy, and untrusted-content boundaries.
• Starts with a 5–25 URL pilot instead of mass sitemap inclusion.
• Uses existing application/CDN/WAF/hosting logs; paid analytics remains optional.
• Separates bot request, fetch, indexation, training, mention, citation, referral, conversion, customer, and revenue states.
• Cross-links the contract from technical SEO.
• Bumps the skill/bootstrap version to 5.2.0 and adds validator assertions.

Non-goals

• No DataFast dependency or provider integration.
• No claim that .md or llms.txt is a Google ranking factor.
• No automatic sitemap rollout, assistant scraping, citation forecast, or GEO scoring model.
• No product-site implementation in this PR.

Risks and controls

• Duplicate/index bloat: canonical HTML stays primary; sitemap inclusion is gated and monitored.
• Representation drift: all surfaces must share one authoritative source and release together.
• Data leakage: companions may expose only approved public data.
• False attribution: bot logs remain request evidence only; downstream outcomes stay separate.

Verification

• node dev/seo-growth-workspace/validate-skill.mjs ✅
• node dev/seo-growth-workspace/command-inventory.mjs --verify ✅ (0 malformed; foreign-CWD executable matrix green)
• git diff --check ✅
• node dev/seo-growth-workspace/evaluate-release.mjs --json ⚠️ expected release-time red: the existing signed manual gate artifact is still gate-results-5.1.0.json and is digest/version-bound. This PR does not fabricate or re-sign the 17 manual release gates; a 5.2.0 release run must refresh that artifact.

Acceptance criteria

• Companion surfaces are conditional, not a default SEO gate.
• Canonical HTML and one source of truth remain mandatory.
• llms.txt, APIs, analytics providers, and sitemap inclusion remain optional.
• Pilot, privacy, canonical, observability, and expansion gates are explicit.
• Bot requests cannot be upgraded into indexing, training, citation, or business outcomes.
• Deterministic skill validation covers the new contract.