deploy(hf): sync szl-holdings/a11oy@main derived COPY set

chore(sync): mirror front-door files to Space (hf-sync)

fix(0-CDN/G7): self-host fonts + vendor three.js; kill runtime CDN on a11oy surfaces (nemo/estate-hologram + full sweep). ADDITIVE/surgical. Mirrors GitHub main 0ce331f.

feat(restraint): R2 front-end - 'Restraint applied' indicator on /nemo (rung+lines-saved+ceilings+signed receipt) and restraint verdict column on /agent-loop trace. Ponytail MIT, governed. Byte-identical to GitHub 3a8305e. Additive; PENDING until R1 live.

F4: 3D inference router + energy hologram + GRC OSCAL matrix (additive, 2D fallback, 0 CDN)

SZL-Nemo core (Lane I1): governed-MoE router + MTP + self-improve + tiers; /nemo tab + /api/a11oy/v1/nemo/* (byte-identical to GitHub)