site: promote CPB + composition — dedicated page, nav, registry accuracy

[StevenMih]

Summary

Implements items 2–7 of asg inbox.md [site-cpb-promote] (item 1, committing the CPB -01 spec source to agent-action-capsule/spec/, is out of scope for this lane — flagged separately, see outbox).

• Accuracy fix — TS implementation claim. Verified locally (vitest, 60/60 passing) and via GitHub Actions CI that the published @agentactioncapsule/emit@0.1.0 passes its bundled 21-vector CPB snapshot — but the canonical scitt-payload-binding vector suite has since grown to 27 vectors (NFC-boundary + nested-array-normalization additions), and the TS suite hasn't been updated. Softened the site's "byte-compatible, independently verified" claim to accurately state the Python reference lib passes the full current suite (CI-verified) and a second implementation (TypeScript) is in progress.
• Accuracy fix — registry links. The site linked to agent-action-capsule/tree/main/test-vectors (AAC's own vectors, unrelated to CPB) and agent-action-capsule/.../cpb-provisional-registry.md (a different, still-provisional candidate list — not where AAC/MachineMandate are registered). Repointed to the real scitt-payload-binding/REGISTRY.md and vectors/. Updated language: AAC is the first registered payload profile; MachineMandate is registering as the second (PR open, pending owner confirmation) — dropped "provisional" framing.
• New /cpb.html page covering both companion drafts side by side: the Composition draft (draft-mih-sato-agent-accountability-composition-00, the CAN/WHO/WHAT/AUDIT framework + shared action-digest join key + assurance tiers) and CPB (draft-mih-sokolov-scitt-payload-binding-01, the binding mechanism — jcs-n, derived identifier, typed reference). Also covers the open registry (three-rung owner-authored / third-party-documented / provisional onboarding ladder) and the conformance rigor (mutation-probe self-test: condition-removed mutants, assertion-free checks fail CI — sourced from scitt-payload-binding/.github/check_vectors.py). Links both drafts, the registry, the vectors, and the reference implementation.
• Landing section strengthened (index.html #cpb, ~L459–489): swapped the overclaiming third card for an honest "open registry" card, added a CTA linking to the new page, fixed the footer link line.
• Nav: added a first-class "Composition (CPB)" item to the top nav sitewide (all pages with nav-links) and to the docs sidebar where present.
• Version sweep: whole-site grep for draft-mih-* citations — found and fixed one stale citation: docs/bilateral.html was still citing draft-mih-agent-bilateral-attestation-00, bumped to -01. All other citations (AAC-02, CPB-01) were already current.
• Added cpb.html to the Dockerfile COPY list (the exact class of trap that bit [site-deploy-push] earlier today) and to sitemap.xml.

Boundary

Mechanism + open registry + vectors + composition only. No KYB, no Authority-operated framing, no reputation/pricing, no two-sided-market/worked-examples language. Self-scanned the diff against the known reserved-vocabulary categories; the automated neutrality CI gate (secret-backed) is the authoritative check — see PR checks.

Test plan

• npx vitest run in capsule-emit-js (publish-fixes branch): 60/60 pass, confirming the TS 21-vector claim before softening it
• python3 -m pytest -q in scitt-payload-binding (cpb-vectors-and-ref-impl branch): 30/30 pass, confirming the Python full-suite claim
• docker build + docker run locally: /, /cpb.html, /cpb (clean URL), /docs/how-it-composes.html, /docs/bilateral.html, /ip.html, /playground.html, /docs/ all 200
• Verified Composition (CPB) nav content served correctly from the built container
• neutrality / dco / other CI checks green on this PR (verify before merge)
• Steven's deploy go + PM post-deploy smoke (not done by this PR — deploy is Steven-gated)

🤖 Generated with Claude Code