H3.4B — Hub Apex Cutover Preparation

[maruson08]

Prepare the repository-side Hub changes required for the coordinated H3.5 apex cutover.

Scope:

• self-referencing Hub canonical and social metadata for https://securetools.app
• Hub-only sitemap and production robots contract
• hostname-specific noindex policy for Pages validation aliases
• exact 18-path legacy Web Utilities redirect artifact derived from the H3.1 URL map
• dependency-free migration validation
• documented apex, www, rollback, and coordinated H3.5 activation runbook

Preparation only. This issue does not authorize merging the preparation PR, attaching the apex domain, changing DNS or Search Console, activating redirects, merging Secure_Tools PR #73, or beginning H3.5.

[maruson08]

Preparation is complete in PR #15.

Static validation passed:

• 10 Hub canonical-bearing routes
• 10 unique Hub sitemap URLs
• 18 exact H3 redirect mappings plus the root no-redirect reservation
• stable and immutable Hub Pages alias noindex configuration
• 1200×630 PNG social preview contract

The PR remains intentionally unmerged. H3.5 will perform the coordinated merge, deployment, www normalization, apex attachment, redirect verification, Web Utilities SEO activation, and rollback-gated validation. No DNS, custom-domain, zone redirect, or Search Console change was made.