Unify current delivery, completed npm setup and deferred hosting; preserve historical evidence

[schchit]

Owner-approved peripheral closeout. Add a stable DELIVERY-CURRENT.md, update directory/profile/status wrapper, replace obsolete owner tasks with completed npm/self-hosting status and retain the exact previous handoff blob under HISTORICAL. Dated audit and hardening reports remain untouched. Account trust and secret cleanup are explicitly owner-confirmed; no actual OIDC upload is claimed. API hosting remains deferred and the isolated Railway trial was cleaned up.

Add a small read-only, non-scheduled public-site HTTP audit (fixed public routes, no secrets, no JS execution, no writes). Cached old extracts are not proof of current source. Current accessible GitHub inventory did not identify the website source; do not edit a guessed repository or Prooftask. Fresh observations and any remaining site-owner action will be documented after the audit.

Coordinated changes: API #16, JS #15, Core #34. No VERSION/publishing/protocol/frozen artifact changes or new resources.

[schchit]

Closeout validation completed. Public audit run 36299281135 passed on the unchanged audit script/workflow; subsequent commits only update Markdown findings and delivery evidence. The five downloaded CI artifacts were checked against their GitHub SHA-256 digests. All 13 original release-file digests were rechecked locally in each Linux/Windows/macOS evidence archive and agree across platforms. Current Core #34, API #16 and JS #15 are merged; their PR checks passed and Core/API main checks are green. Dated reports remain unchanged; the prior handoff and retired bootstrap are preserved by their original blob SHA.

Website audit is not a deployment. Fresh HTTP bodies confirm updated primary protocol/architecture pages and narrower remaining example/old-route/metadata issues. Vercel installation was confirmed after the owner's 06:16 UTC message, but action discovery exposes no Vercel project/deploy actions in this session. Record that exact limitation, not a claim that installation failed. No reinstall/token or new hosted resources requested.