feat(seo): add evidence-backed search foundations

[Luigi1010101]

Release decision

Draft — blocked for merge. The repository currently exposes no branch-protection rule, repository ruleset, or protected production environment, so this PR must remain a draft until an owner configures the controls listed below. E-GITHUB-001

What this changes

• observed Adds exact canonicals, robots directives, Open Graph/Twitter metadata, safe JSON-LD, an original 1200×630 social card, normalized internal URLs, data-derived page metadata, crawlable entity links, and intrinsic image dimensions. E-PATCH-001 E-IMAGEGEN-001
• observed Adds a rendered-output verifier, skill-coverage policy, actual built-app malicious-data tests, and PR Quality workflow. E-POST-001 E-POLICY-001
• observed Rebases onto the latest main, preserves its 150 pure simulator assertions and component/module split, and repairs runtime DOM, parsed-base, currency-mapping, paste-visibility, and initial-layout contracts caught only by the built-app gate. E-UPSTREAM-001
• observed Makes external-data refreshes bounded and fail-closed, proposes refreshed artifacts through a review PR, and disables production deployment by default until owner-side release controls are configured. E-PATCH-001
• inferred This intentionally establishes crawl, metadata, entity, evidence, and release foundations; it does not disguise unresolved catalogue UX and generated-page quality as fixed. E-SXO-001 E-CONTENT-001

Rendered evidence

Measure	Base	Proposed
HTML pages	3,764	3,764
Indexable pages with canonical	0	3,762
Indexable pages missing shared social fields	3,763	0
Duplicate indexable title groups	34	0
Non-normalized internal page-link occurrences	76,704	0
Rendered image occurrences missing dimensions	45,522	0
Indexable pages with zero internal inlinks	3,429	2,823
Titles over 60 characters	926	1,030

observed These values come from full deterministic parses of both rendered trees; the remaining zero-inlink pages and long titles are disclosed advisories, not hidden pass conditions. E-HTML-001 E-GRAPH-001 E-POST-001

Verification

• observed npm run check passes: 150 pure assertions; 3,764 pages built; 3,762 indexable pages; 2 intentional noindex pages; 3,755 valid JSON-LD blocks; exact canonical/sitemap parity; zero duplicate indexable titles; zero missing image dimensions; simulator, calculator, and optimizer malicious-data fixtures pass. E-POST-001
• observed Final mobile simulator lab result: performance 88, SEO 100, LCP 3,796 ms, and CLS 0.0060 after reserving the loading-to-empty-state layout. E-PERF-001
• observed Builds under LC_ALL=C and sv_SE.UTF-8 produced the same rendered-output hash. E-POST-001
• observed git diff --check and npm ci --dry-run pass. E-POST-001
• observed Repository-wide npx tsc --noEmit still fails on the pre-existing TypeScript 7 baseUrl/path configuration. E-BASETEST-001
• observed npm audit still reports the existing high-severity sharp <0.35.0 advisory. E-NPM-001
• observed Production-versus-preview release guard is unavailable until a preview URL and Search Ops site UUID exist. E-LIMIT-001

Immutable source binding

• Base commit: 30ce69dee0ed941441dd2251f81433fccfeae273
• Head commit: 1f5d1d335c76862d16f66fb261e4d351b90cdb04
• Head tree: fa192bf291dd68da575dc2c999b90e14fb48ae9b
• Canonical binary/full-index patch SHA-256: eb30be0e0e157999f9bf511526d97e6a91a95ac1790d19cd67ea965d870f8df9
• Proposed rendered-output SHA-256: de78b672ef10a014620e7c944ad8f51523009e14fe99af12b98834162df58106

Patch digest definition:

git diff --binary --full-index 30ce69dee0ed941441dd2251f81433fccfeae273..1f5d1d335c76862d16f66fb261e4d351b90cdb04 | shasum -a 256

The machine-readable receipt and reproduction commands are committed at docs/seo-evidence-2026-07-23.json. E-PATCH-001

Required owner actions before review/merge

1. Configure a main ruleset: PR required, Quality required, direct/force pushes blocked, stale approvals dismissed.
2. Create a protected production environment: restrict deployment to main, require an owner reviewer with no bypass, and move Cloudflare credentials to environment-scoped secrets.
3. Set PRODUCTION_RELEASE_GUARD_CONFIGURED=true only after those controls are verified.
4. Resolve or explicitly accept the existing TypeScript and sharp gates.
5. Generate a preview and run the production-versus-preview release guard before merge.

documented Do not move this PR out of draft until these controls and the combined Cloudflare robots response are verified. E-GITHUB-001 E-CLOUDFLARE-001

Risk, rollback, and measurement

• inferred Risk is medium because shared templates affect thousands of static routes. E-PATCH-001
• documented Roll back by reverting head commit 1f5d1d335c76862d16f66fb261e4d351b90cdb04. E-REPO-001
• documented Measure organic users who start a simulator/calculator flow, with canonical/sitemap errors, soft-404 signals, render failures, and field CWV as guardrails; avoid causal claims from a simple before/after comparison. E-MEASURE-001

Full report: docs/seo-audit-2026-07-23.md