docs: clarify shared-agent positioning and refresh product media

Makefile

@@ -543,9 +543,18 @@ audit:
 # target was added: `next` and `postcss` raised, `nanoid` and `js-yaml` pinned
 # forward through their parents.
 AUDIT_LEVEL ?= high
+# The one other case is a finding with no fixed release anywhere in its chain: it
+# is named here with the path it arrives by and the condition that removes it,
+# and the audit ignores that advisory only.
+#   GHSA-vfj7-8cjw-p6xm (CVE-2026-93687): braces <= 3.0.3 has no patched release.
+#   It reaches the tree only through eslint-config-next > @next/eslint-plugin-next
+#   > fast-glob > micromatch, a lint-time dependency that the built console does
+#   not ship. Remove when braces publishes a fix or @next/eslint-plugin-next
+#   drops fast-glob. bun matches advisories by their GHSA id, not the CVE.
+AUDIT_IGNORE ?= GHSA-vfj7-8cjw-p6xm
 
 audit-frontend:
-	cd frontend && bun audit --audit-level=$(AUDIT_LEVEL)
+	cd frontend && bun audit --audit-level=$(AUDIT_LEVEL) $(addprefix --ignore=,$(AUDIT_IGNORE))
 
 # A CycloneDX inventory of what the *source tree* declares, written to `sbom/`.
 #
@@ -708,19 +717,28 @@ docs-slug-check:
 	uv run --directory backend --group docs pytest -q \
 		tests/test_check_docs_i18n.py::test_the_slug_derivation_matches_the_renderer
 
-# The client presentation is `docs/presentation/index.html` - a published page,
-# and the only copy. This renders the same file to a PDF for sending, and checks
-# it. The PDF is not committed: at 6 MB it is over the large-file limit, and it
-# is a derivative of a file that is already here.
+# Two decks are published pages, and the only copies: the 14-slide open-source
+# introduction at `docs/presentation/index.html` (served at /presentation/) and the
+# 44-slide product tour at `docs/presentation/tour/index.html` (/presentation/tour/),
+# which shares the introduction's `media/` and `fonts/`. Both are guided decks that
+# show one slide at a time, so printing either page gives one page, not a deck.
+# This checks what the README promises - each deck's slide count - and that every
+# file a deck names resolves. A PDF of every step is built from a deck's source with
+# the content-deck skill (`guided.py DECK --pdf`), not from these pages.
 #
-# DECK_TOOLS points at the `deck-build` skill, which is not in this repository.
-DECK_TOOLS ?= $(HOME)/.claude/skills/deck-build/tools/deck
-DECK_PDF ?= $(HOME)/notes/001_System/Assets/agenticos-deck/out/agenticos-client-deck.pdf
+# CONTENT_OS points at the content toolkit behind the `content-deck` skill, which is
+# not in this repository; `scripts/gen` runs its tools with the toolkit's Python.
+CONTENT_OS ?= $(HOME)/PycharmProjects/content-os
+PRESENTATIONS := docs/presentation/index.html:14 docs/presentation/tour/index.html:44
 presentation:
-	@test -d "$(DECK_TOOLS)" || { echo "deck-build skill not found at $(DECK_TOOLS)"; exit 1; }
-	python3 "$(DECK_TOOLS)/finalise.py" docs/presentation/index.html
-	python3 "$(DECK_TOOLS)/build.py" pdf docs/presentation/index.html -o "$(DECK_PDF)"
-	python3 "$(DECK_TOOLS)/verify.py" deck "$(DECK_PDF)" --expect-slides 20
+	@test -x "$(CONTENT_OS)/scripts/gen" || { echo "content toolkit not found at $(CONTENT_OS); set CONTENT_OS="; exit 1; }
+	@for entry in $(PRESENTATIONS); do \
+		deck=$${entry%%:*}; expected=$${entry##*:}; \
+		found=$$(grep -c '<section class="slide' "$$deck"); \
+		test "$$found" -eq "$$expected" || { echo "$$deck: $$found slides, expected $$expected"; exit 1; }; \
+		echo "$$deck: $$found slides"; \
+		"$(CONTENT_OS)/scripts/gen" tools/deck/verify.py assets "$$deck" || exit 1; \
+	done
 
 # Migrations against a real database, forwards and back. The only way to know a
 # backfill or a check constraint actually works.

SECURITY.de.md

@@ -27,7 +27,7 @@ Das Bedrohungsmodell, die Datenfluss-Erklärung (was das Deployment verlässt un
 an wen), was wo verschlüsselt ist, und die Kontrollmatrix — jede Kontrolle auf den
 Mechanismus abgebildet, der sie erfüllt, und auf den Test, der sie hält — stehen
 in einer einzigen Kopie auf der Seite
-[Sicherheit](https://vstorm-co.github.io/agenticos/security/) (`docs/security.md`).
+[Sicherheit](https://vstorm-co.github.io/agenticos/de/security/) (`docs/security.md`).
 Diese Datei behält nur die zwei Dinge, für die man die `SECURITY.md` eines
 Repositorys liest: wie man eine Schwachstelle meldet, oben, und die
 Härtungs-Checkliste für die Produktion, unten. Wo personenbezogene Daten liegen

SECURITY.es.md

@@ -27,7 +27,7 @@ El modelo de amenazas, la declaración de flujo de datos (qué sale del deployme
 y hacia quién), qué se cifra y dónde, y la matriz de controles — cada control
 mapeado al mecanismo que lo satisface y al test que lo sostiene — viven en una
 sola copia en la página
-[Seguridad](https://vstorm-co.github.io/agenticos/security/) (`docs/security.md`).
+[Seguridad](https://vstorm-co.github.io/agenticos/es/security/) (`docs/security.md`).
 Este archivo conserva solo las dos cosas para las que se lee el `SECURITY.md` de
 un repositorio: cómo informar de una vulnerabilidad, arriba, y la lista de
 endurecimiento para producción, abajo. Dónde viven los datos personales y qué

SECURITY.pl.md

@@ -25,7 +25,7 @@ Celujemy w potwierdzenie w ciągu 48h i wypuszczenie poprawki w ciągu 7 dni dla
 Model zagrożeń, opis przepływu danych (co opuszcza wdrożenie i do kogo), co jest
 gdzie szyfrowane oraz macierz kontroli — każda kontrola zmapowana na mechanizm,
 który ją realizuje, i na test, który trzyma ją w mocy — żyją w jednej kopii na
-stronie [Bezpieczeństwo](https://vstorm-co.github.io/agenticos/security/)
+stronie [Bezpieczeństwo](https://vstorm-co.github.io/agenticos/pl/security/)
 (`docs/security.md`). Ten plik zostawia tylko dwie rzeczy, po które sięga się do
 `SECURITY.md` w repozytorium: jak zgłosić podatność, powyżej, i produkcyjną listę
 kontrolną hardeningu, poniżej. Gdzie leżą dane osobowe i co obejmuje usunięcie,

backend/tests/test_check_docs_i18n.py

@@ -374,7 +374,7 @@ def test_a_root_translation_of_a_deleted_file_is_orphaned(repository: Path) -> N
 
 
 def test_the_github_slug_answers_the_fragments_the_readme_links_to() -> None:
-    """GitHub's rule, checked against the six fragments `README.md` already uses.
+    """GitHub's rule, checked against the fragments `README.md` links to.
 
     The one that matters is `#-quick-start`: its heading opens on an emoji, and
     the space the emoji leaves behind becomes a leading hyphen. Derive the anchor
@@ -440,3 +440,30 @@ def test_the_guard_asks_about_every_locale_the_site_builds() -> None:
     )
     built = {language["locale"] for language in i18n["languages"]}
     assert built == {docs_i18n.DEFAULT_LOCALE, *docs_i18n.LOCALES}
+
+
+def test_published_documentation_links_follow_the_readme_locale(docs: Path) -> None:
+    for name in ("index.md", "mcp.md", "about/index.md"):
+        page = docs / name
+        page.parent.mkdir(parents=True, exist_ok=True)
+        page.write_text("# Page\n", encoding="utf-8")
+        page.with_name(f"{page.stem}.pl.md").write_text("# Strona\n", encoding="utf-8")
+    readme = docs.parent / "README.md"
+    base = "https://vstorm-co.github.io/agenticos/"
+    targets = [
+        base,
+        base + "mcp/#tools",
+        base + "about/",
+        base + "pl/mcp/",
+        base + "missing/",
+        "https://example.com/mcp/",
+    ]
+    readme.write_text("\n".join(f"[Link]({url})" for url in targets), encoding="utf-8")
+    assert docs_i18n.linked_targets(readme, into="pl") == [
+        base + "pl/",
+        base + "pl/mcp/#tools",
+        base + "pl/about/",
+        base + "pl/mcp/",
+        base + "missing/",
+        "https://example.com/mcp/",
+    ]

docs/assets/channels/ATTRIBUTION.txt

@@ -0,0 +1,11 @@
+Channel logo tiles
+
+Slack now uses the official full-color SVG linked from slack.com, replacing
+the previous monochrome Font Awesome glyph. Mattermost and Telegram retain
+their Simple Icons glyphs (CC0 1.0). Light and dark frames match the other
+application tiles used in the README.
+
+Full sources, attribution and connection scope:
+../integrations/ATTRIBUTION.txt
+Source and output hashes:
+../integrations/manifest.json