Prevent host rewriting on project site

[truegoodcraft]

Summary

• send Cache-Control: no-cache, no-transform from the root project artifact
• prevent Cloudflare email-link rewriting and injected decode code without changing zone-wide behavior
• enforce the production response policy in contract coverage

Validation

• npm run project:check
• 4 unit/contract checks passed
• Chromium, Firefox, and WebKit project-site checks passed

Live defect

The initial production response exposed Cloudflare-obfuscated mail links. Release the exact merge commit through release/project after this PR passes.