docs: correct the fourth review's statements, a claims check, the font licence (DR-187, task 1.1)

[datajace]

Task 1.1 of spec implement-every-recommendation-of-fourth (DR-187): every statement the fourth review found the artefacts contradicting, re-verified first; a claims check in npm test; the font licence.

#	Statement	Where	Now
1	a 1.0 reader keeps reading every 1.2 artefact	docs/upgrading-1.0-to-1.2.md	a 1.2 reader reads conformant 1.0 output; a 1.0 reader may reject 1.2 output (1.0.2 schemas reject two valid fixtures, named)
2	details key filter "mirrors" the writer	README, SECURITY, CHANGELOG 1.1.0, audit-event and cdi-signal descriptions	"approximates", case-sensitive, differences listed (Authorization, API_TOKEN, TokenCount, x-Token admitted; apiToken2, myFile2 refused)
3	110 entries cover 115 tightenings	CHANGELOG 1.2.0, CONTRIBUTING	58 of the 110 (v1.1.0 to v1.2.0), checked
4	every schema carries schema_version	README, SPEC §6.2, upgrading note, CHANGELOG 1.2.0	the seven named; config-core and the plugin schemas do not
5	RFC 9485 I-Regexp	SPEC §4.4, schema descriptions, proposals, CHANGELOG 1.1.0, two code comments	ECMA-262 subset compiling under RE2, unanchored search
6	issuer "cannot mint" R7+	lease-record reasonCode	MUST NOT mint; pattern admits R7 to R99
7	empty code span	CHANGELOG [Unreleased]	$comment
8	/1.x/ serves 1.2.1	CHANGELOG 1.2.1, site front and versions pages, README, suite export labels	/1.x/ serves main, may be description-ahead of the tag
9	1.0.x ids were tag objects	docs/decisions.md	commits f575139, df0b1f8, 54c134b (tag objects named), checked
10	DR-182 still Proposed	docs/decisions.md	Approved
11	666 declared properties	CHANGELOG 1.2.0, tool-args proposal	651 declared + 15 condition keys = 666 keys (649/664 at 1.2.0), checked
12	six other validators	GOVERNANCE, CHANGELOG 1.2.0, README Layout	six validators, Ajv among them; job name kept (required check)
13	Two extensions	README, CHANGELOG 1.1.0	three
14	Both run on every push and PR, Node 20 and 22	README (quoted on /conformance/)	npm test on 20 and 22, guard on 22, PRs and pushes to main; self-contained
15	push baseline is the previous commit	README	github.event.before
16	995 beside 4,588	README	two populations named (front-matter blocks vs journal lines)
17	Two further lines	docs/implementing.md	three (guard, Layout, Site) plus the claims line
18	reference shows every constraint	tooling/site-reference.mjs	enums >10 in full inside <details>; self-test asserts every value
19	every version links a GitHub Release	tooling/build-site.mjs	1.0.x link their tag, labelled; constant FIRST_GITHUB_RELEASE from CHANGELOG 1.1.0
20	a zero count fails	docs/conformance/cdf-harness.md	empty lease journal passes
21	one :root palette	CHANGELOG [Unreleased]	three :root blocks
22	SPEC date; eleven spellings	SPEC header, §6.2, §13; README; CHANGELOG 1.2.0	editorial revisions dated, §13 row; ten distinct values
-	CI comment says narrowing vectors run	contract.yml	shape only, behaviour NOT CHECKED
-	private review links	docs/decisions.md	summaries, private documents named as such
-	Source Sans 3 licence named Google Inc.	tooling/site/fonts	upstream Adobe text (RFN "Source"); JetBrains Mono upstream text; BRAND-NOTICE records it

Claims check: conformance/claims-check.mjs, 56 claims, in npm test; NOT CHECKED per claim from the package or without tags; conformance job now fetch-depth: 0. Mutation proof: README "40 valid" to 41 failed npm test naming readme-valid-fixtures; restored by cp, cmp identical.

Schemas: description text only; guard against origin/main reports no finding; lock unchanged.

🤖 Generated with Claude Code