Ship the ClumL company mark instead of a product logo

[sehkone]

Closes #38.

shared/brand.svg was the Clumit Security wordmark — aice-web-next's product logo, shipped to every consumer. aimer-web documents Clumit Insight and already carried its own copy; an earlier audit read that as drift, and it was not. It was a consumer correctly refusing an asset that did not belong to it. bootroot and agentcoop document neither product, so adopting the theme as it stood would have put another product's branding on their manuals — and bootroot's site is public.

Three assets, not one

Installed as	Lettering	Used for
brand.svg	white	site header, on the primary-coloured bar
brand-print.svg	black	PDF cover, on white paper
brand-symbol.svg	cube alone	favicon

The two wordmarks differ in exactly one declaration (.cls-2: #c9c9c9 → #fff); every path is identical. Names describe where each is used, not what background it was drawn for — the source file called BlackBG is the one with white lettering, which inverts confusingly.

The PDF script had to change in the same commit. It read docs/theme/brand.svg, which now carries white lettering; leaving it would have rendered an invisible logo on white paper, with nothing downstream reporting it.

Product logos still work

Vendoring removed the way aimer-web and aice-web-next keep their own marks: docs/theme/ is covered by the .meta digest, so an edit there is reverted on the next installer run.

• HTML already worked — theme is a mapping, and mappings merge recursively on INHERIT, so setting theme.logo overrides just that key. Verified in the tests that theme.features and theme.palette survive.
• The PDF cover did not. Added extra.pdf.cover_logo, a path relative to docs_dir. A path that does not resolve is an error, not a silent fall back to the company mark — falling back would hand a consumer a cover branded with the wrong name.

Documented in a new README "Branding" section, including that product assets go under docs/, never docs/theme/.

Verification

• tests/pdf-test.sh gains four checks, all passing: the cover defaults to brand-print.svg and not to brand.svg; an overridden cover_logo reaches the rendered cover; an unresolvable override fails naming the key; a missing brand-print.svg fails rather than producing a logo-less cover.
• The override check uses a fixture SVG carrying a <text> element, so the substitution is observed in the rendered page rather than only in the generated config — pdftotext finds the marker.
• tests/installer-test.sh asserts all three assets install.
• Both samples build --strict; the built HTML references theme/brand.svg and theme/brand-symbol.svg, and both are present in site/.
• Rendered the header logo composited on Material's indigo (#3f51b5): the white lettering is legible.
• shellcheck and markdownlint-cli2 clean.

Note

brand-print.svg is copied into site/ although only the PDF build reads it. It is 2.7 KB and adding an exclude_docs rule for it costs more clarity than the bytes are worth. Say the word if you would rather it be excluded.