chore: voice + filename hygiene + wave-4 state wrap

Maintainer-voice sweep across `src/`. ~190 references to the
maintainer by first name in code comments and JSDoc neutralised to
"the maintainer", "the live tenant", "users", or "the user" depending
on context. Three sed passes covering ~50 distinct patterns
(`Marc reported`, `Marc wants`, `Marc kept`, `Marc rolled back`, etc.).
Test fixtures (`displayName: "Marc B."`, `username: "marc"`,
`<HeroStrip userName="Marc">`) kept as opaque test data per the brief.

CHANGELOG normalisation. The v1.4.14 + v1.4.15 entries paired a
German bullet with its English translation by historical design — the
in-app copy is English-default and the user docs are English, so the
mixed-language style was a holdover from the early-marathon notes.
A one-off node script extracted the `_..._` English paragraph from
each bilingual bullet and rewrote the entry as that text. ~44 bullets
reduced; one Docs bullet that lost a leading word in the regex
fixed by hand.

CLAUDE.md → CONTRIBUTING-AI.md rename so the filename is no longer
AI-vendor-specific. `CONTRIBUTING.md` reference updated. `AGENTS.md`
stays in place for multi-agent compatibility (the conventions doc is
shared with Codex / Cursor / etc.).

Wave-4 state wrap. STATE.md now records C1–C5 + D + D2 as complete;
v1421-backlog.md grew a "Closed in v1.4.22" header listing the 20
items the marathon landed; `.planning/phase-W4-report.md` documents
the per-commit decisions, test deltas, and the 23 items deferred to
v1.4.23 with reasoning.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/api/internal/deploy-webhook/route.ts

@@ -22,7 +22,7 @@ import { prisma } from "@/lib/db";
  * comes back asynchronously when the container is healthy / fails to
  * start. Without this surface we lose visibility once the deploy is
  * fired — exactly the gap that produced v1.4.6..v1.4.14's manual
- * verification recipe (Marc had to SSH and check digests).
+ * verification recipe (the maintainer had to SSH and check digests).
  *
  * Payload shape: Coolify sends a free-form JSON object whose exact
  * fields drift between beta releases. We treat it as `Record<string,
@@ -104,7 +104,7 @@ function hasValidSecret(request: NextRequest): boolean {
  * `src/lib/integrations/status.ts` — fan out a SYSTEM_ALERT through the
  * existing dispatcher to every user whose role is ADMIN. The dispatcher
  * silently no-ops when no Telegram channel is configured, so this is
- * safe even on a first-deploy where Marc hasn't wired the bot yet.
+ * safe even on a first-deploy where the maintainer hasn't wired the bot yet.
  */
 async function notifyAdminsOfFailure(event: NormalizedEvent): Promise<void> {
   const admins = await prisma.user.findMany({