feat(marketing): phase 4 — the marketing pages

PLAN.md §13 phase 4: /features/, /architecture/, /modules/, /integrations/, and
/community/ — plus the two scope items the phase table never assigned to anyone.

Six decisions taken by the org lead before coding, recorded in PLAN.md §10 as
D20-D25:

- D20 /features/ is the homepage's list with a `detail` line, not a second list.
  One data file, two renderings, so they cannot disagree about what exists.
- D21 /architecture/ draws reasons, not reference: three new inline SVGs, one per
  boundary. No endpoint tables, no config keys — those are phase 8's and stay
  canonical in docs/.
- D22 The deliberate absences of §2 become one tagged data file, rendered on the
  three pages that promise them.
- D23 Phase 4 absorbs /community/ (specified in §10 and §14 N3, linked from the
  header since phase 1, built by no phase) and checkLinks.mjs.
- D24 `needsModule`: writing the Teams detail exposed a false claim phase 3
  shipped. Teams are module-sourced only — teams.module_id is NOT NULL, there is
  no create route, sync is gated on providerModuleId() — so the Community group
  no longer says a bare core does all of it.
- D25 The per-capability demo affordance brand.json had promised since phase 2 is
  a deep link, filled at boot from data-demo-path.

checkLinks.mjs reads the built HTML rather than src/, because half these links
are assembled from data files and template literals. Its PLANNED_ROUTES list is
checked in both directions, so it cannot rot into a permanent exemption.

applyBrand.mjs gained a pass that recomputes deep links from their immutable
path, making it idempotent and reversible; checkBrand.mjs lifts that pattern out
and runs it against the stock markup so the two cannot drift. Both proved
against a real mount, in both directions.

Fixes a cascade bug the checks could not see: [data-demo-url=''] and a scoped
component class are both specificity 0,1,0, so .demo-link's `display` beat the
hide rule and twelve links to a nonexistent demo rendered, each resolving to the
current page. The rule is now !important.

The four diagrams' shared SVG vocabulary moved to src/styles/diagram.css.

Verified from a clean checkout: npm ci, all five checks, astro check (0 errors),
production build, and a live browser pass at desktop and 390px.

Co-Authored-By: Claude <noreply@anthropic.com>

scripts/applyBrand.mjs

@@ -175,6 +175,34 @@ if (demoFrom !== demoTo) {
   replacements.push({ field: 'demoUrl', from: attr(demoFrom), to: attr(demoTo) });
 }
 
+/**
+ * The demo's DEEP links (§15 / D25), which `/features/` writes one of per capability that
+ * has a stable public route:
+ *
+ *     <a class="demo-link" href="" data-demo-url="" data-demo-path="/uo/market">see it live</a>
+ *
+ * The slot above cannot express these. It is a literal string swap of a whole URL, so it
+ * can only ever put the demo's root in an `href` — and reversing it would not even find a
+ * deep link, whose `href` is the root plus a path and therefore matches no literal the
+ * script knows.
+ *
+ * This pass is a different shape on purpose: it does not replace a previous value, it
+ * RECOMPUTES both attributes from `data-demo-path`, which never changes. That makes it
+ * idempotent and exactly reversible, so it runs unconditionally in the loop below rather
+ * than only when the demo URL moved. `data-demo-url` is still filled with the bare root
+ * because `global.css` hides `[data-demo-url='']` — the visibility rule stays one rule for
+ * both kinds of link, and only the `href` differs.
+ */
+const DEEP_LINK = /href="[^"]*" data-demo-url="[^"]*" data-demo-path="([^"]*)"/g;
+
+const deepLinkTo = (demoPath) => {
+  const href = demoTo ? `${demoTo.replace(/\/+$/, '')}${demoPath}` : '';
+  return (
+    `href="${escapeHtml(href)}" data-demo-url="${escapeHtml(demoTo)}" ` +
+    `data-demo-path="${demoPath}"`
+  );
+};
+
 if (!replacements.length) {
   console.log('[brand] mount matches what is already applied; nothing to rewrite.');
   process.exit(0);
@@ -198,6 +226,7 @@ function* walk(dir) {
 }
 
 const counts = new Map(replacements.map((r) => [r.field, 0]));
+counts.set('demoDeep', 0);
 let filesTouched = 0;
 
 for (const file of walk(CLIENT)) {
@@ -210,6 +239,15 @@ for (const file of walk(CLIENT)) {
     after = after.split(from).join(to);
   }
 
+  // After the literal swaps, never before: the plain-slot replacement also matches the
+  // first two attributes of a deep link, so it runs first and this pass corrects the
+  // `href` it just wrote. Recomputing rather than replacing is what makes that safe.
+  after = after.replace(DEEP_LINK, (whole, demoPath) => {
+    const rebuilt = deepLinkTo(demoPath);
+    if (rebuilt !== whole) counts.set('demoDeep', counts.get('demoDeep') + 1);
+    return rebuilt;
+  });
+
   if (after !== before) {
     writeFileSync(file, after);
     filesTouched++;
@@ -226,6 +264,11 @@ for (const { field, from, to } of replacements) {
 if (demoFrom !== demoTo) {
   console.log(`  ${'demoUrl'.padEnd(14)} ${demoTo ? `slot shown -> ${demoTo}` : 'slot hidden'}  (${counts.get('demoUrl')}x)`);
 }
+if (counts.get('demoDeep')) {
+  console.log(
+    `  ${'demoUrl deep'.padEnd(14)} ${demoTo ? `linked -> ${demoTo}/…` : 'links hidden'}  (${counts.get('demoDeep')}x)`
+  );
+}
 
 // Pagefind builds its search index from the HTML at BUILD time (phase 10), so a rename
 // applied here reaches the pages but not the search results. Worth fixing when search