Keep sign-ups unlinkable on ActivityPods, and land the pending coherence-pass work

Participation privacy (decision_2026-10-29_participation-privacy-mechanism):
a sign-up is a private Join naming the meeting point, addressed to nobody,
handled by the backend on emission. Attendee lists hold member URNs hashed
from (WebID, event, a secret kept in the participant's profile), so counts
stay public and only contacts recognise anyone; the creator has no read
right and is notified anonymously. Each person's participations collection,
created by the backend at the first sign-up, is readable by their /contacts
WAC group only, never world-readable. The member URN is sticky per
(meeting point, participant) and every collection write is verified by
reading back, so a refused write leaves the act unrecorded and retryable.
The EventRef mechanism and its browser-side provisioning are gone.

The backend now runs with WebACL on, as the reference apps do, on its own
secure datasets festipod / settings-festipod instead of the pod provider's
settings dataset; pod-notifications needs it. The compose header and the
deployment leaf say how to reset a stack whose datasets predate this.

The rights matrix covers the new mechanism live (148 hard lines), including
a forged contact Accept between throwaway accounts: the stranger enters the
contacts list (platform defect, reported upstream) but is refused the profile
and the participations. Tests may attack as long as they never break the dev
environment (rule_tests-never-break-the-dev-environment).

Also lands the coherence-pass work that was still uncommitted: contacts as
the Pod's social graph and invite links, image upload to the Pod, the
meeting-point form, profile completion gate, and the doctrine for them.
Superseded briefs and decisions are deleted rather than annotated.

backend/services/attendees.service.js

@@ -4,14 +4,17 @@ const CONFIG = require('../config/config');
 const { neverThrowingMatcher, verifiedEmit, uriOf } = require('./emitted-activity');
 const { guardedCreateAndAttach } = require('./collection-attach');
 
-// Attaches an `apods:attendees` collection (and a WAC group of the same members) to every
-// `as:Event` created in a user's pod that this backend learns of through the outbox watcher —
-// plain events as well as meeting points (observed 2026-10-12). A join adds the actor to it.
+// Attaches an `apods:attendees` collection to every `as:Event` created in a user's pod that this
+// backend learns of through the outbox watcher — plain events as well as meeting points (observed
+// 2026-10-12). A join adds the participant's MEMBER URN to it (never a WebID — see
+// registration.service.js, member-urn.js and decision_2026-10-29_participation-privacy-mechanism),
+// so the collection's members are opaque URNs only readers of the participant's secret (they, their
+// contacts, the app) can recognise, and no WAC group mirrors them.
 //
 // Who may read the collection: the pod creates it world-readable (`acl:Read` for `foaf:Agent`) — a
-// platform default, observed 2026-10-12, not a choice made here. Whether attendee lists of a PUBLIC
-// event SHOULD be world-readable is an open product question (the functional-domain doctrine places
-// participation in the protected scope); this service does not settle it. What it does settle: the
+// platform default, observed 2026-10-12, not a choice made here. The collection is the PUBLIC
+// surface of a participation: a count of opaque members, no identity (the model, per
+// knowledge_data-scopes-and-discovery — not an open question). What this service settles: the
 // collection it creates never stays more readable than its event. Once attached, it records that
 // collection's public read as Festipod's (`public-read.recordCreated`) and asks `public-read.reconcile`
 // to align the event AND its collection with the event's current public intent — granted while the
@@ -26,7 +29,9 @@ module.exports = {
       ordered: false,
       summary: 'Meeting point attendees'
     },
-    createWacGroup: true
+    // Members are member URNs, not agents — a mirrored WAC group would be meaningless
+    // (decision_2026-10-29_participation-privacy-mechanism).
+    createWacGroup: false
   },
   dependencies: ['public-read'],
   // The mixin's create handler would act on the object embedded in the (unauthenticated) webhook