Summary

• enforce the complete docs verification gate in read-only, SHA-pinned GitHub Actions
• make source and dependency checks retry transient infrastructure failures while failing closed on drift and vulnerabilities
• add bounded DNS, TLS, HTTP, and canonical deployment-health validation
• add Vercel security headers, MIT licensing, and public repository operations documentation

Validation

• npm ci --ignore-scripts
• npm run check — 115 tests, production build, zero production vulnerabilities, and 16 public source contracts
• git diff --check origin/main...HEAD
• production browser audit at 1280px and 390×844 across home, MCP, Node API, troubleshooting, and 404 routes
• robots and sitemap verification

Deployment follow-up

docs.linkout.space previously presented an expired *.linkout.space certificate dated May 18, 2026. This PR adds a manual deployment-health workflow but does not modify DNS or Vercel project settings. Renew or reissue the certificate separately, then run the manual workflow before enabling any schedule.