C-04: hide completion and fault rates on testnet (no-rate restriction)

[randomblocker]

Stacked on #85 at 25f4c58, with C-01 integrated from main. Head: de70e1c.

Directory users see “Completion verification unavailable” and labelled observations. New and cached projections publish null metrics with a reason and TP-1 metadata, remove unknown cached rates, ratings and scores at seller, deal and listing level, and supply listing hints with observed category counts and snapshot windows in the shape the pinned SDK catalog reader accepts. Completion/rating filters, including bracketed keys, and sorting/ranking requests return 400. Evidence inspection, counts and currency totals remain available with their limitations stated. Full metrics return under a later reputation contract.

TP-1 is defined in-tree in reference-implementations/dacs-directory/docs/TP-1.md, measured against DACS Standard d45c0a29. It declares the Directory's open nonconforming deviations in the Standard's ImplementationDeviation shape. The manifest reports dacsDirectoryVersion: "2" and restrictions: ["TP-1"], the OpenAPI document is 2.0.0, and the ListingSummary schema is served with a short, revalidated cache lifetime.

Observed counts follow DACS-4 SB-1/SB-2 settlement uniqueness:

• Each success-evidence paymentTxRefs entry is projected to its SB-1 settlement-tx-id (demos:{txHash}, including the legacy { rail: "demos", txHash } ref; evm:{chainId}:{txHash}:{logIndex} for evm-event and x402-event; solana:{cluster}:{signature}:{instructionIndex}). A deal citing a ref that can't be projected without ledger data isn't counted.
• The complete admissible set is grouped by that id before windowing. A group claimed by more than one record or (jobId, phaseIndex) is void, because the Directory verifies no settlement-side binding authority. Seller reputation, indexed listing hints and served hints share this rule, and a served hint's count is recomputed from retained records.
• The SB-1 ledger-event check and the anchor-address phaseIndex recovery aren't implemented. Both are declared as open deviations in docs/TP-1.md.

This combined head also includes two build changes beyond the W restriction:

• Fonts load through next/font/local using two exact, integrity-pinned runtime packages. The earlier font failure came from a network guard; it did not show that CI required this switch. The owner decides whether to retain it.
• identityBundleHash imports through the SDK verification seam from its pure implementation. This resolves a client-build import error introduced by Align Directory listing admission with current SDK #85. A build failure on Align Directory listing admission with current SDK #85 alone is inferred from the recorded import trace; that head was not built independently. The owner decides whether to port the import change into Align Directory listing admission with current SDK #85 before merging it.

Because main is merged here, the diff against #85 also contains main's #84/C-01 removal until #85 is updated from main. C-01 is included in this head and remains a merge prerequisite.

Validation at de70e1c: the 36 unit/component files that reach the changed modules pass 309/309 (node --import tsx --test --test-concurrency=2), and typecheck reports 0 errors. The previous head passed all 47 files (351 tests) and next build. Six retained browser cases were not run; no lint command is configured. Open for the owner: sign-off on deferring the SB-1 phaseIndex derivation and the ledger-event check.

🤖 Generated with Claude Code