Apply final-review cleanup: robots sitemap, CI guards, header parity

- Remove Sitemap line from robots.txt (no @astrojs/sitemap installed; was
  pointing to a 404 that would trip Google Search Console).
- Align Permissions-Policy across all three enforcement layers (middleware,
  .htaccess, Cloudflare Transform Rule in OPERATOR-CHECKLIST) by dropping the
  stray fullscreen=(self) from the middleware.
- Bump Lighthouse CI numberOfRuns from 1 to 3 to dampen CI-runner noise.
- Add CI guard that fails the build if any <TBD:...> marker survives into
  dist/ — prevents a legally incomplete imprint from shipping by accident.
- Add SFTP_* secret null-guard before the rsync --delete step so a missing
  secret fails loudly instead of targeting the SSH user's home root.
- Document the set:html compile-time-constant invariant in DualValueProps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/sections/DualValueProps.astro

@@ -4,6 +4,8 @@ interface Tile {
   capability: string;
 }
 
+// tile.capability is a compile-time constant defined below — never feed
+// user-supplied or CMS content into set:html further down (XSS risk).
 const tiles: Tile[] = [
   {
     outcome: 'Cut debugging time in half.',