✨ H3.4A — Web Utilities SEO Cutover Preparation

[maruson08]

Summary

• prepare all 18 canonical-bearing Web Utilities pages, Open Graph/X image URLs, sitemap, and robots declaration for \https://tools.securetools.app\`n- retain the intentional noindex legacy alias and all 19 H3 migration paths
• scope the generated Pages _headers\ rules to stable and versioned \pages.dev\ hostnames so the custom domain can become indexable without Workers or Pages Functions
• prepare deployment validation for tools-host canonical/social metadata and document the coordinated H3.5 activation and Search Console follow-up

Validation

• 
  ode tests/run-all.mjs`n- \git diff --check`n- 18 canonical pages and 18 sitemap URLs
• no old-host or pages.dev URL in active HTML/search metadata
• no application JavaScript, CSS, asset, redirect, Worker, or Pages Function change
• live H3.3 endpoints independently revalidated from \origin/main: 19 routes and 7 assets on securetools.app, tools.securetools.app, and the stable pages.dev bridge

Coordinated activation gate — do not merge

This preparation PR must remain open until H3.5 coordinates the Hub apex cutover, legacy path redirects, Hub canonical activation, retirement of the old Secure_Tools GitHub Pages apex path, and Web Utilities indexing activation. A normal independent merge would publish conflicting SEO signals.

No DNS, Cloudflare custom-domain, GitHub Pages, Search Console, apex/\www, Hub, H3.4B, H3.5, redirect, or application behavior change was performed.

Refs #72