feat(site): seed the product site from the Vite/React Router proof

[Bugs5382]

What and why

I'm seeding the real product site on top of the hub scaffold, from the approved proof (served at
the review build Shane looked at). I kept the proof's look, hero, marks and sections as they are --
no redesign -- and changed only what the repo needs on top of it: license headers, CI and docs.

• app/: React Router v7 in framework mode (ssr: false, prerender() in
  react-router.config.ts), prerendered to static HTML at build time, no Node server at request
  time. One route (/), composed from app/content/cryptos.ts (all of this product's copy) and a
  set of product-agnostic components (hero, nav, section, feature grid, terminal card, footer).
• vendor/cryptos-ui/: a vendored copy of cryptos-web's packages/ui design kit, at commit
  6720003 (documented in vendor/cryptos-ui/NOTICE, which also says how to refresh it). It's
  copied in because cryptos-web doesn't publish this package; it's read-only here.
• Dropped the scaffold's placeholder src/ SPA, index.html, and the vitest/testing-library
  stack that came with it (nothing here has business logic to unit-test; CI builds, lints,
  typechecks and checks the prerendered output's links instead).
• License: same Apache 2.0 switch as chore(license): switch to Apache 2.0 and credit the original author #1 (LICENSE, NOTICE, AUTHORS, golic config, README
  Acknowledgements) -- this PR replaces every file that one touches under the old src/, so I
  carried the same change here rather than leaving this branch on the MIT placeholder. Whichever
  of these two PRs merges second will need a rebase; expect a conflict on the license-plumbing
  files since both branches touch them independently off main.
• CI: a ci.yml job (lint, typecheck, build/prerender, then scripts/check-links.mjs against the
  prerendered output for broken internal links), a job-dco.yaml (copied from cryptos-web), and a
  release-drafter.yml (also copied from cryptos-web's shape) replacing the scaffold's generic
  job-version-bump.yaml, which was hardcoded to the Bugs5382 release App's client ID -- wrong App
  for a CryptOS-PKI repo. The new one is App-gated the same way (vars.APP_CLIENT_ID), extends
  CryptOS-PKI/.github at its current main SHA, first-version: 0.1.0, rc prereleases.
• Every action used by a PR-triggered workflow in this repo (the new ones and the scaffold's
  existing golic/PR-checks/label/license-check/actionlint workflows) is now pinned by commit SHA,
  and every job runs on ubuntu-24.04.
• Docs: README, AGENTS.md and CLAUDE.md updated for the real layout (CLAUDE.md's "Project layout"
  section notes that this repo diverges from the hub's vite/app baseline, which has no
  framework-mode/prerendered layout yet -- a possible follow-up for project-template, out of scope
  here).

Verification

• Lint clean
• Tests pass
• Build succeeds
• Documentation updated (if behavior or API changed)

How this was verified

• task license (dry run): every source file carries the header, LICENSE is verbatim. (golic does
  not descend into vendor/; its headers already match, copied as-is from cryptos-web, and
  vendor/cryptos-ui/NOTICE documents the source commit.)
• npm run lint, npm run typecheck, npm run build all pass locally. npm run build prerenders
  / to build/client/index.html.
• node scripts/check-links.mjs build/client: checked the prerendered HTML, no broken internal
  links (3 external links counted, not fetched).
• actionlint -shellcheck= passes on every workflow file.
• No test suite (see above); nothing here has business logic to unit-test.

---

I'll add a closing comment summarizing what was done before this merges.

Refs #3