Add honest deployment-source attestation

Route receipt verification through canonical A11OY API (#1)

fix: allow huggingface.co to frame the Space (App-tab embed was blocked by frame-ancestors 'self')

SZL Cosmos · Hanan Pacha — consolidated holographic substrate (org-map + cathedral + khipu), real vendored bloom