Publish the shell.online posts on the blog, and send /blogs to /blog/

[Alexgodoroja]

What changes for the user?

shell.online/blog/ (live since #309 but empty) now lists every shell.online post published so far: 23 posts from 2026-09-02 to 2026-09-30, imported from pilotprotocol.network.

• Each post keeps its title, description, category, tags, date, author and banner, and names its pilotprotocol.network URL as canonical (so it stays out of our sitemap and doesn't compete in search).
• Relative links in the bodies (/blog/..., /docs/, /trust, /app-store) pointed at pilotprotocol.network pages and now say so explicitly. Links to another imported post stay on shell.online.
• /blogs and /blogs/<anything> answer a 301 to the same path under /blog/. Both paths are added to run_worker_first in wrangler.example.jsonc, and the landing SEO check enforces it.
• CHANGELOG: Unreleased → Added entry for the blog (including the entry Add a blog at /blog/ #309 proposed).

The two open website blog PRs (pilot-protocol/website#278, #281) are not included; they aren't published yet.

Verification

• npm run check → exit 0; 67 files, 778 tests passed (new /blogs redirect test; the registry test validates all 23 entries and bodies), plus the installer, landing SEO, mobile, deploy guard, QEMU and formula checks.
• npm run build:web → 23 post pages, index, feed, sitemap and 23 banners in dist/blog/.
• wrangler dev --config wrangler.example.jsonc with Host: shell.online: /blog/ 200 with 23 cards; posts 200 with the canonical link; /blog 307; /blogs, /blogs/ and /blogs/<slug>/ 301 to /blog/...; /blog/nope/ 404; feed, sitemap and banners 200.
• Headless Chrome at 1280px (index) and 400px (a post): no console errors, no horizontal scroll, every banner image loads.

Access and privacy

No change to authorization, terminal input, passwords, encryption or stored content.

• No real share links, credentials, private terminal content or deployment secrets are included.
• User-facing docs and the changelog are updated.

Rollout

Website and Worker only. The private production config needs /blogs and /blogs/* in run_worker_first before the next relay deploy (check-worker-routing refuses it otherwise).