H3.4B — Hub Apex Cutover Preparation - #15

Summary

• prepare self-referencing Hub canonical and social metadata for https://securetools.app
• add a 10-URL Hub sitemap and production robots contract
• keep stable and immutable Hub pages.dev aliases non-indexable with static hostname-specific _headers
• add the exact 18 legacy Web Utilities 301 mappings from the H3.1 URL map
• add dependency-free SEO/redirect validation and pull-request CI
• document the coordinated H3.5 www, apex, Web Utilities SEO, rollback, and Search Console sequence

Validation

• python scripts/validate-h3-url-map.py
• python scripts/validate-h3-hub-cutover.py
• git diff --check origin/main...HEAD
• local static HTTP smoke: 10 Hub routes and representative CSS/favicon/social/robots/sitemap assets returned 200

Activation boundary

Preparation only. Do not merge this PR before the coordinated H3.5 change window.

This PR does not attach securetools.app, change apex or www DNS, activate a zone redirect, modify Search Console, alter the existing GitHub Pages custom domain/workflow, or merge Secure_Tools PR #73. Feature-branch pushes do not run the production deployment.

Refs #14