merge: coverage debt paid — 51/51, and the root really did hide a service

R-C2-01 and R-C2-02 were the last two uncovered requirements (49/51). Now
100% with 0 gaps, via an offline L0 check (49 assertions) that compares two
repository facts: every home-zone hostname the repo routes over HTTP must be
linked from the apex dashboard, and every link the dashboard offers must
resolve to something the repo actually serves at L7 or L4.

'A service the root hid' was still a live defect: crafty.${BASE_DOMAIN} was
served and reconciled while nothing on the root linked to it. Committed RED
first so the history shows the check catching it, then fixed.

Also fixes a regex that could never have worked: ci/touched-requirements.sh
matched R-[A-Z]+-[0-9]+, where [A-Z]+ eats the C of R-C2-01 and then demands
a dash where the 2 is — so a manifest declaring either ID attributed nothing.
Every other consumer already used [A-Z0-9]+.

16 mutations proven caught. R-TLS-02's drafted amendment is recovered into
DECISIONS-LOG: revocation is not implementable with cert-manager, and the
choice between amending the requirement and a reviewed DOCUMENTED_GAPS entry
is the owner's.

# Conflicts:
#	DECISIONS-LOG.md

platform/homepage/configmap.yaml

@@ -81,6 +81,18 @@ data:
             href: https://qbittorrent.${BASE_DOMAIN}
             description: Download client (VPN egress)
             icon: mdi-download-network
+        # Crafty Controller — a running, north-south-exposed web UI (platform/crafty/httproute.yaml,
+        # reconciled by clusters/base/crafty.yaml) that this dashboard did NOT surface until
+        # 2026-09-13. R-C2-01 says the root MUST surface "the services running in the cluster and
+        # links to them", so an unsurfaced route is a requirement gap, not a styling preference —
+        # conformance/tests/l0-static/c2-root-surface fails on one now. Grouped under Media because
+        # it manages game servers; regrouping it under Platform would be purely cosmetic. The game
+        # ports themselves (crafty-mc.${BASE_DOMAIN}, TCP 25565-25567 / UDP 19132-19134) are an L4
+        # LoadBalancer with no browsable URL, so this tile is how they are surfaced.
+        - Crafty:
+            href: https://crafty.${BASE_DOMAIN}
+            description: Minecraft server manager (Keycloak-gated)
+            icon: mdi-minecraft
 
     - Network & Infra:
         - Pi-hole: