docs: professional-voice pass and CI voice gate (S11)

[patterncatalyst]

Section S11 of the modernization plan: a professional-voice pass over every reader-facing page, README and diagram label, and a CI gate that keeps ban-tier phrasing out.

What changes

• Rewrites across all chapters and appendices, the example pages, READMEs and 16 diagram labels (each changed in the SVG, both text and originalText of the .excalidraw, and any alt text or caption that repeats it). Code, commands, recorded output and link targets are byte-identical to main.
• Ban tier 95 -> 0 and watch tier 239 -> 108 over the gated scope; every remaining watch hit is kept with a reason (literal minikube/OpenShift subjects, machine-subject "silently", result tables, idioms, identifiers, planned-stage "deliberate").
• scripts/voice/ vendors the lgtm-professional-voice scanner byte-identical from lgtm-skills a335007 (PRs fix: embed diagrams in advisory DOCX #48 and feat(demo-01): add Quarkus implementation for cloud-native principles #49 fixed a scratch-file bug and added missing patterns), with a provenance README.
• scripts/voice-scan.sh defines the gated scope and runs as a step in content.yml, so content-ok fails on any ban-tier phrase; CLAUDE.md documents it.
• Plans: S10 marked done; S11 plan, per-file evidence table and ledgers.

Verification

• Opus validation, one repair round, final recheck (merge verdict): code-identity and edit-locality scripts, full word-diff read for meaning drift, Jekyll builds of main and HEAD (same pages and links; ids changed only for six reworded headings with no inbound anchors), diagram render and label checks, gate injection proofs (page, README, SVG fail; inline code and fenced blocks pass), mawk/gawk parity, actionlint and shellcheck clean.