fix(posts): consultant round-2 convergence (v1.2)

01 payments (EN+ZH)
- idempotency gate is now a whitelist: only PENDING and a late-settled
  EXPIRED may enter fulfilment. Checking only for FULFILLED left the whole
  PROCESSING window open to a second queue push (consultant finding).
- k-of-n -> two-tier: both chassis anchors (SMBIOS board UUID + CPU
  architectural signature) matching is sufficient; if one anchor changed,
  every auxiliary digest must match. Aux dimension moved off the volatile
  OS GUID onto permanent NIC MAC.
- FSM diagram: RETRY_QUEUE branches from PROCESSING, not FULFILLED

02 comfyui covers (EN+ZH)
- subscribe the WebSocket BEFORE queue_prompt, settimeout(120),
  try/finally ws.close(), /history fallback on timeout: fixes the
  lost-terminal-frame hang and the per-image socket leak
- document Pillow half-wave rectified Laplacian (offset=0 clamps negative
  responses to 0) and why a signed float kernel would not work here
- replace the unverifiable "89 covers in 48 minutes" with the filesystem
  evidence: 216 assets (108 banner+OG pairs) inside a 25.9-min window
- ZH: drop the colloquial imperative; add self-bootstrapping note

03 traefik yaegi (ZH)
- the .traefik.yml contract paragraph and scoreThreshold 120 had only
  landed in the EN file; both now applied to ZH
- <summary> line counts corrected 29 -> 30 in both languages (verified
  programmatically for all eight code blocks)

layout
- standing provenance note in the site footer (sanitised client
  identifiers / production thresholds), per consultant Q7 ruling

src/layouts/BaseLayout.astro

@@ -217,13 +217,17 @@ const inSection = {
 
     <footer class="site-footer">
       <span>© {new Date().getFullYear()} {SITE.author} · {SITE.handle}</span>
-      <span>
+      <span class="site-footer-links">
         <a href="/rss.xml">RSS</a>
         <a href={SITE.linkedin} target="_blank" rel="noopener">LinkedIn</a>
         <a href={SITE.github} target="_blank" rel="noopener">GitHub</a>
         <a href={SITE.gitea} target="_blank" rel="noopener">Gitea</a>
         <a href={SITE.website} target="_blank" rel="noopener">hoelee.com</a>
       </span>
+      <span class="site-footer-note">
+        Case studies reflect architectural patterns engineered by the author; client identifiers and
+        production thresholds are sanitized for operational security.
+      </span>
     </footer>
 
     <Search lang={lang} />