The Agent Behaviour Policy becomes a page, and Lisbon gets a landing page

Three new pages, and the plumbing they needed. The site had been arguing the Agent Behaviour Policy's contents for months without the artefact having a name; it has one now, with a published model behind it.

• The Agent Behaviour Policy↗ is a page. The four objects and how each is obtained, the four barriers and the enforcer test, the confirmations-on/off pair where one barrier moved and not a single number did, the rule that a behaviour policy carries no score and where the score does live, the label/record/prescription ladder, and the business case a control can be sold on. Every figure links to the published data it came from rather than restating it.
• Lisbon↗ has a landing page for the Startup Summit on 17–18 September: what we are showing, in order; four conversations with one ask each; press boilerplate at three lengths with an accurate/not-accurate table beside it; and every brand asset, free to take. It carries the not-affiliated notice and sends anybody asking about the event to the organiser.
• An exhibitor operations page, which is the first page on this site that is deliberately not published: unlisted, noindex, kept out of the sitemap and llms.txt, and disallowed in robots.txt. It holds the organiser's booth guide and our own action list. site/ is a public web root, so that makes it unadvertised rather than protected, and the page says so on itself.

The page list has one home. It used to be inlined in all 24 pages with nothing keeping them in step — a test could see them disagree but nothing could fix it, and adding a page meant editing every page. site/pages.json is now the source and the inlined copy is injected from it. A page can be marked unlisted (no menu entry) or private (also no twin, no sitemap, no llms.txt, noindex, robots-disallowed).

Two defects fixed on the way, both older than this release.

• The header bar overflowed its own 1100px cap by 33px, before these pages existed, and by 137px with them. Library, Partners, Give feedback and Brand collapse into a More group, which brings six top-level entries back inside the cap, and the mobile drawer's breakpoint moves from 880px to 980px to close a band where the bar overflowed with no drawer to fall back on. No page scrolls sideways at any width now, which was not true of any release before this one.
• The lockup SVGs clipped their own wordmark. riskmandate-lockup-light.svg and its dark twin set the wordmark as an SVG <text> element inside a 260-unit viewBox, so the final letter was cut off in any font wider than the one it was drawn against — including whatever a printer would have used. The viewBox is 320 now, and the print deliverables are laid out as real type rather than as a fixed-width drawing, so there is nothing left to clip.

Two new tools, neither of them a build step. scripts/site/new-page.mjs scaffolds a page with the chrome lifted from a page already in site/, so a new page cannot ship an older copy of the header, the drawer or the shared modules. scripts/site/render-brand-exports.mjs renders the brand exports at the sizes an exhibitor portal and a LinkedIn page actually ask for.

Tests: 19, from 17. Internal links now also check that a #fragment resolves to an id in the page it points at, which caught a wrong anchor before it shipped; private pages are asserted noindex, twin-less and robots-disallowed; and pages.json has to account for every page in site/ and vice versa.