fix(templates): clean exemplars — pass the oracle, green on first push

What and why

Templates are exemplars an agent (or human) reads and copies, so they must themselves be clean. Consuming the reference to bootstrap a greenfield project surfaced two defects that would ship in every project built from a template:

1. A fresh project fails the conformance oracle — avatar.svg carries the dated GitLab Public Sector, 20XX. footer the repository standard forbids.
2. A fresh docs project reds CI on first push — the template ships site/package.json with no site/package-lock.json, and CI runs npm ci.

The changes (9 files)

Area	Change
avatar.svg / hero.svg (×3 templates)	Drop the dated GitLab Public Sector, 20XX. footer the repository standard already forbids (ages every January, overflows the 256×256 canvas). The brand-band wordmark stays.
standards/repository/check.sh	The hero bare-year rule was case-sensitive and the template shipped the uppercase form, so it never fired (dead rule). Now matches the comma-year-period footer shape directly, case-agnostic.
templates/docs/site/package-lock.json	Committed (placeholder name preserved) so the first npm ci resolves.
templates/paper/README.md	Adds the posture compliance-matrix link docs + lab already carry (paper was missing it).

Validation

A freshly built docs project passes the oracle: 17 standards, 0 failed. Negative test: reintroducing the footer (in the uppercase form the old rule missed) now fails repository.

Draft for review. Part of the "we used this greenfield, here is the simplification" cleanup; the build-system + bootstrap-model simplification follows in a stacked MR.