fix: close private-beta canary blockers

[ericsocrat]

Purpose

Close the two launch blockers proven by the live invited-user production canary:

• the only tester feedback route published hello@example.com;
• products with no usable score provenance could still say Excellent, repeat affirmative health guidance, display legacy Verified confidence, and color traffic-light guidance.

Changes

• Route private-beta feedback to the monitored TryVit GitHub issue channel, with truthful EN/PL/DE copy and no response-time promise.
• Keep provisional numeric scores visible for reference, but replace band verdicts, positive headlines, ranking guidance, legacy verified-confidence treatment, and traffic-light colors with explicit no-guidance copy until score provenance is usable.
• Extend that fail-closed treatment through expanded Nutrition and detailed score-breakdown views.
• Preserve raw nutrition and DV values with neutral styling while explaining that provenance is insufficient for traffic-light guidance.
• Align the contact Route-JS identity contract with the exact monitored feedback URL.
• Refresh deterministic inventory ancestry and record the canary fix in the changelog.

Verification

• Initial focused product/contact tests: 119 passed.
• Localization/dictionary contracts: 74 passed.
• Review follow-up product tests: 112 passed.
• Route-JS measurement contracts: 30 passed.
• Type-check, lint, production build, PR Gate, CodeQL, hygiene, immutable comparator, Golden Reference, Quality Gate, screenshots, and Vercel preview: passed.
• Both Lighthouse measurement steps were skipped; no Lighthouse measurement ran.
• The PR Route-JS workflow did not reach size comparison because its base-owned contact identity still required the removed placeholder address. This PR updates that exact contract for main; no dependency was added and the failure was route-identity-mismatch:contact, not a size-threshold breach.
• Renderer attestation remains inherited base-owned mutation-test noise and is not applicable to this product change.
• npm run verify is not defined in this repository.

Scope

No auth/provider, onboarding, scanner, scoring formula/threshold, database/schema/RLS/data, dependency, baseline, renderer, Lighthouse, or performance-policy change. The production watch action created by the canary remains pending Eric's requested confirmation before its exact user-owned reversal.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tryvit	Ready	Preview	Aug 27, 2026 9:14pm

[github-actions]

📸 PR Screenshots

Captured 2 screenshots (1 mobile, 1 desktop) for 1 changed page(s):

• contact

📥 Download screenshots from workflow artifacts.

_{Captured by PR Screenshots workflow • 2026-08-27}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 17cd98b6d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".