Stability checkpoint — Phase 2 complete + Phase 3 (DEMO1+DEMO2) + CI hygiene

Phase 2 UI shipped this cycle:
- 2.3 D1  OpenAPI→TS types auto-gen + CI drift gate (2c6179a)
- 2.4 T1  axe-core Playwright a11y on login/root/chaos (5abc0cc)
- 2.7 DEMO3 signals-driven guided tour + 🎓 topbar button (cd021b9)

Phase 3 UI shipped this cycle:
- 3.3 DEMO1 /find-the-bug interactive (cae69a2) — 3 puzzles:
            rate-limit, circuit-break, aggregate-storm
- 3.4 DEMO2 /incident-anatomy scripted walkthrough (136f2da) —
            6-step timeline: alert → runbook → trace → fix → verify

Plus: Auth0 end-to-end (interceptor race + multi-role isAdmin),
      devcontainer, ESLint 9 + angular-eslint + SARIF → SonarCloud,
      compodoc CVE override batch.

CI hygiene: openapi:types-drift (bash install + skip-if-fresh cache),
            gitleaks Auth0 public-id allowlist, tightened npm cache
            (NPM_CONFIG_CACHE + .npm/ paths + SHA marker).

New CLAUDE.md rules: file length hygiene + Docker cleanup 4 triggers.

MR !67 (24 commits) merged; post-merge main pipeline #322 green.