Contract verification page, cache-busted assets, no-withdrawal line

/contract: plain-language security review with the six design laws, honest
operator CAN/CANNOT lists, split walkthrough, oracle bridge and anti-stall
notes, testing summary, live explorer + Sourcify verified-source links
(config-driven so it follows the mainnet flip). Nav gains The contract.
All asset URLs now carry a version query so deploys bust browser caches
(the level-cycler stall). Earn-deeper checklist leads with: no withdrawal
requests, ever.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

public/assets/common.js

@@ -32,6 +32,7 @@ window.IAP = (function () {
       + '<a href="/" data-p="home">How it works</a>'
       + '<a href="/#ladder" data-p="pricing">Ad packages</a>'
       + '<a href="/ledger" data-p="ledger">Live ledger</a>'
+      + '<a href="/contract" data-p="contract">The contract</a>'
       + '<a href="/my" data-p="my">Members</a>'
       + '</span><span id="navWallet" class="muted">…</span></div>';
     document.body.prepend(nav);