Publish PALO Guide and guide-only MCP

[sev7enITA]

What changed

• adds the responsive PALO Guide and makes Ask PALO a first-class route
• reduces homepage and Evidence Pack navigation density across desktop and mobile
• adds deterministic, source-grounded PALO route inference
• exposes three read-only MCP guide tools and the palo_guide_agent prompt
• prepares a separately authenticated /mcp-guide VPS route with its own secret and least-privilege allowlist
• updates public documentation, sitemap, release manifest, build validation and responsive smoke coverage

Why

PALO v3.0.1 needed a clearer path from framework orientation to accountable next steps on both desktop and mobile. Product integrations also needed a bounded guide surface that remains separate from protected-action authorization and execution.

User and developer impact

Users can open PALO Guide directly, describe a governance situation and receive a transparent route with reasons, artifacts, evidence class and authority boundary. MCP-capable products can consume the same released framework through three read-only tools. Operators receive separate Compose, Caddy and nginx configuration for the guide-only endpoint.

The public Guide is browser-local and does not require an account. The MCP service remains a bearer-authenticated developer preview and is not a production authorization boundary.

Validation

• npm run validate:agentic
• npm run validate
• npm run build
• npm run validate:dist
• npm run build:check
• npm run smoke
• docker compose config for Caddy and Hostinger/nginx variants
• shell syntax checks
• git diff --check

The Docker daemon was not running locally, so the container image build itself is left to CI or the VPS deployment step.