🔧 H3.3 — Tools Subdomain Parallel Validation

[maruson08]

Summary

• prepare continuous validation for the future \ ools.securetools.app\ Pages custom domain
• reuse one deployment smoke contract for the immutable Pages deployment, stable pages.dev alias, custom domain, and existing GitHub Pages production
• document the manual browser gate, Cloudflare activation order, TLS/DNS invariants, SEO isolation, and rollback

Preparation validation

• 
  ode tests/run-all.mjs`n-
  ode tests/deployment-smoke.mjs https://secure-tools-web-bridge.pages.dev\`n-
  ode tests/deployment-smoke.mjs https://securetools.app production`n- \git diff --check`n- 19/19 routes and 7 representative assets pass on both current endpoints
• bridge returns exact \X-Robots-Tag: noindex, nofollow; production does not inherit it
• production canonical/og:url inventory remains on \securetools.app`n

Activation gate — do not merge yet

This PR intentionally expects exactly \ ools.securetools.app\ on the Pages project after activation. Keep it open until:

1. human browser QA on the current pages.dev bridge confirms one PDF, one image, and one metadata operation plus no file uploads in the Network panel;
2. \ ools.securetools.app\ is attached through the Pages project's Custom Domains flow and TLS is active;
3. the prepared deployment smoke test passes against the custom domain; and
4. bridge and existing production isolation are revalidated.

No DNS or custom-domain operation was performed in this preparation run. No apex, GitHub Pages, Search Console, canonical, sitemap, redirect, application behavior, H3.4, or v3 change is included.

Closes #70