CanaryAgent becomes the sixth public surface

- CanaryAgent product page joins the public site; navigation gains Threat Log and Referral.
- Sitemap points to public pages instead of auth-gated ones; crawler-safe robots, branded 404, and a non-leaky RAG error message.
- Post-sign-in cleanup: real workspaces, no marketing loops, fake onboarding step removed.