chore(sync): mirror front-door files to Space (hf-sync)

Automated front-door sync from szl-holdings/a11oy main via hf-sync.
Added/updated: cathedral.html, cathedral_genius.html, console/docs.html, console/index.html, console/pricing.html, console/throne-room.html, console/throne-room.js, live_wires.html, pages/api-keys.html, pages/assurance.html, pages/audit.html, pages/ayni.html, pages/brain-dual.html, pages/brain-jack.html, pages/brain.html, pages/chaski.html, pages/codex-kernel.html, pages/company.html, pages/compliance.html, pages/console.html, pages/counter-uas.html, pages/cued-engagement.html, pages/docs.html, pages/energy-ops.html, pages/evidence.html, pages/fabric.html, pages/gap-report.html, pages/harvest.html, pages/hatun-mcp.html, pages/hub.html, pages/integrations.html, pages/landing.html, pages/mesh.html, pages/observability.html, pages/operator_organ.html, pages/pinn-console.html, pages/pinn.html, pages/pnt.html, pages/pricing.html, pages/run-all.html, pages/sdk.html, pages/security.html, pages/status.html, pages/substrate.html, pages/superpowers.html, pages/throne-room.html, pages/throne-room.js, pages/uds.html, pages/upgrades.html, pages/verify.html, pages/wallpa.html, pages/warhacker.html, pages/wasi-rikuq.html, pages/wires.html, static/a11oy_cathedral.js, static/cathedral_app.js, static/shared/szl_codename_sanitizer.js, static/shared/szl_holo3d.js, static/shared/szl_label_engine.js, static/shared/szl_receipt_cosign.js, web/agent-loop.html, web/agentic-gpu.html, web/autoreview.html, web/console.html, web/console_index.html, web/constitution.html, web/defense-readiness.html, web/determinacy.html, web/dns.html, web/elite_console.html, web/energy-3d.html, web/energy-harvest.html, web/energy-holographic.html, web/energy.html, web/estate-hologram.html, web/fleet-c2.html, web/formulas.html, web/governance.html, web/holo.html, web/hologram.html, web/immune.html, web/index.html, web/living-anatomy.html, web/materials.html, web/nemo.html, web/operator.html, web/quant.html, web/restraint-bench.html, web/restraint.html, web/sda.html, web/signature-is-not-proof.html, web/v4_fleet_panel.html
Deleted (gone from GitHub main): (none)

Keeps the served front-door (pages/*.html, console/*.html) identical
to GitHub main so an HF factory rebuild never drops a GitHub edit or
keeps serving a page that was deleted on GitHub.

pages/assurance.html

@@ -471,6 +471,26 @@
       <span class="chip chip-modeled">MODELED</span> model-derived ·
       <span class="chip chip-roadmap">ROADMAP</span> planned / not yet delivered
     </div>
+
+    <!-- Auditor Evidence Pack: one signed, offline-verifiable JSON bundling the
+         assurance matrix + khipu organ chain heads + lake health + doctrine snapshot,
+         self-hashed (sha3_256) so an auditor can re-verify offline. -->
+    <div style="margin-top:20px;border:1px solid var(--border);border-radius:var(--radius);padding:16px 18px;background:var(--bg-card);">
+      <div style="font-weight:700;font-size:14px;margin-bottom:4px;">Auditor Evidence Pack</div>
+      <div style="font-size:12px;color:var(--text-dim);margin-bottom:12px;">
+        One signed, offline-verifiable JSON bundling the assurance matrix, khipu chain heads
+        (re-walked <code>links_intact</code>), the lake health snapshot, and the doctrine
+        snapshot — self-hashed with <strong>sha3_256</strong> so an auditor re-verifies offline.
+        Honest: integrity is COMPUTED, not asserted; signature is the demo key (NOT production cosign).
+      </div>
+      <div class="btn-row">
+        <button class="btn btn-primary" id="evidence-pack-btn" onclick="downloadEvidencePack()">
+          Download Evidence Pack
+        </button>
+        <a class="btn" href="/api/a11oy/v1/assurance/evidence-pack" target="_blank">View JSON →</a>
+      </div>
+      <div id="evidence-pack-status" class="status-line"></div>
+    </div>
   </section>
 
   <!-- =====================================================================
@@ -952,6 +972,45 @@ async function checkFit() {
   }
 }
 
+/* ==================================================================
+   SECTION B' — Download Auditor Evidence Pack (sha3_256 self-verifiable)
+   ================================================================== */
+async function downloadEvidencePack() {
+  var btn = el('evidence-pack-btn');
+  if (btn) btn.disabled = true;
+  setStatus('evidence-pack-status', 'Assembling evidence pack from live surfaces…', true);
+  try {
+    var resp = await fetch('/api/a11oy/v1/assurance/evidence-pack');
+    var data = await resp.json();
+    var text = JSON.stringify(data, null, 2);
+
+    var blob = new Blob([text], { type: 'application/json' });
+    var url = URL.createObjectURL(blob);
+    var a = document.createElement('a');
+    var stamp = (data.generated_at || new Date().toISOString()).replace(/[:.]/g, '-');
+    a.href = url;
+    a.download = 'a11oy-evidence-pack-' + stamp + '.json';
+    document.body.appendChild(a);
+    a.click();
+    document.body.removeChild(a);
+    setTimeout(function(){ URL.revokeObjectURL(url); }, 4000);
+
+    // We do NOT recompute sha3_256 in-browser (WebCrypto has no SHA3, and shipping a
+    // hand-rolled hash would risk a false result — honesty over a fake green check).
+    // The digest + exact canonicalization are in the pack so an auditor re-verifies
+    // offline with a trusted sha3_256 tool. We only surface what the server reported.
+    var sig = (data.signature || {});
+    var sigMsg = sig.signed ? (' · signed [' + (sig.keyid || 'demo') + ']') : ' · honest-unsigned (DSSE_PLACEHOLDER)';
+    setStatus('evidence-pack-status',
+      '✓ Downloaded. sha3_256=' + String(data.pack_sha3_256 || '').substring(0, 24) + '…' + sigMsg +
+      ' · re-verify offline per the pack’s digest_canonicalization note.', false);
+  } catch(e) {
+    setStatus('evidence-pack-status', '⚠ Could not assemble evidence pack: ' + e.message, false);
+  } finally {
+    if (btn) btn.disabled = false;
+  }
+}
+
 /* ---- boot ---- */
 window.addEventListener('DOMContentLoaded', function() {
   loadMatrix();