fix: prevent oversized homepage response headers

[mustafazeydani]

What changed

• stop injecting the agent-discovery Link header into normal HTML middleware responses
• add candidate and public deployment checks for header size and duplicate discovery links
• use real homepage GET requests in private and public smoke tests
• document the response-header safety gate

Why

Repeated discovery links expanded the homepage response headers beyond Nginx's first-buffer limit, causing production 502 responses even while the Next.js container remained healthy.

Impact

The homepage remains within an 8 KiB response-header budget, discovery metadata stays available through its stable routes, and future releases fail before cutover if the regression returns.

Validation

• pnpm verify
• pnpm check
• bash -n devops/production/bin/release.sh
• production build smoke checks for /, /ar, /index.md, and /.well-known/api-catalog
• public and private production health checks after the Nginx mitigation