Harden SEO and public governance contracts

[YSCJRH]

Summary

• Harden the Pages SEO contract for canonical, hreflang, x-default, sitemap, Open Graph URL, JSON-LD URL, BreadcrumbList, and FAQPage scope.
• Add public:check for public-surface governance, runtime-secret, artifact-order, workflow-major, npm-install, and BYOK boundary checks.
• Truth-sync v0.3.2 release metadata, report artifact-version wording, Chinese first-run docs, AGENTS, repo-local activation/adoption skills, and issue Roadmap: activation and adoption hardening #33 follow-through notes.

Validation

• corepack pnpm install --frozen-lockfile
• corepack pnpm public:check
• corepack pnpm test (56 tests)
• corepack pnpm typecheck
• corepack pnpm demo:fixture
• corepack pnpm build:site
• corepack pnpm seo:check
• corepack pnpm pack:cli:dry-run
• git diff --check

Release posture

• Do not push a release tag from this PR.
• Continue skipping npm publish: @answerlens/cli still returns 404, so release distribution should remain GitHub release assets + Pages until trusted publishing or NPM_TOKEN is intentionally configured.
• After merge, Pages/CI can publish the hardened public site; any semver release should use the existing release workflow with npm skipped.

Refs #33