fix(u6): fold the cold code-review panel — four-arm convergence on three surface clauses

/heid-code-review panel 01M35CK8YKEKMV7T15JXEF6A8N, verdict NOT drift-zero.
Three findings arrived from all four arms independently, and they share a
shape: a contract clause written as prose and never converted into an
assertion. That is the lens working.

- The panel dropped the added date the contract promised to show.
- `bench ls` printed no ids, and the URL it printed was truncated to 52 columns
  so the line was not pasteable into `bench state|rm`. The test's docstring
  claimed it printed ids and asserted nothing of the kind.
- `bench import` printed the description instead of the raw URL beside each
  normalized id, hiding the collapse the clause exists to expose.
- An IPv6 literal lost its brackets: http://[::1]:8080/a normalized to
  http://::1:8080/a, a broken identity that no re-post can match. Bracketed
  literals are re-wrapped; an unbracketed one is refused rather than guessed.
- A deeply-nested JSON RecursionError escaped read_benches' except pair. The
  byte cap does not help -- 200k open brackets is 200 KB.
- An empty board hid the whole benches panel, registration form included.
- The link refusal classified by captured-text emptiness, which bash can erase;
  it now answers with a B:/N sentinel so no name reads as "not a booth".

INV-4's tie-break falsifier could not fail: _write_all serializes with
sort_keys=True, so both insertion orders came back already id-sorted and
removing the tie-break left the test green. It now calls order_benches
directly. Same class as the five vacuous U4 falsifiers, found by a cold reader
rather than by us.

Also from the arms' per-invariant vacuity pass: INV-6 had no vector pinning a
non-default port as part of the identity; INV-3 asserted only that links/ was
absent; INV-8's hashed sequence omitted a read verb; INV-9's AST walk is
defeated by a string import. All closed.

Contract amended where the code was right: `updated` means last mutation, the
id cap is write-only because the id is the locator controls post back, INV-8's
file list includes the lock sidecar it always mandated. Every line number is
out of the prose -- the panel found two already stale.

565 -> 593 tests. Nothing declined.

booth/app.py

@@ -932,6 +932,14 @@ def create_app(
                 # every other booth, so this pair is read only when it renders.
                 # `read_benches` never raises; a damaged registry costs its own
                 # panel and says so, which is the v0.2.2 lesson.
+                # `is_board` is PAGE IDENTITY, not page content. Gating the
+                # panel on `board or benches` hid it — and its registration
+                # form — exactly when the board was empty and the registry
+                # absent, which is the state a new deployment starts in and the
+                # one where "no benches registered yet" is most worth saying.
+                # A panel that disappears when it has nothing to show is the
+                # same defect as a damaged panel rendering as an absent one.
+                "is_board": (booth / LINKS_FILE).is_file(),
                 **dict(zip(("benches", "benches_error"),
                            read_benches(data_dir) if (booth / LINKS_FILE).is_file()
                            else ([], None))),