insights: coming-soon page; block AI training crawlers; fix stale e2e

- /insights/ is a reader-facing Coming soon page; developer cards removed
- robots.txt: Disallow GPTBot, ClaudeBot, Google-Extended, CCBot,
  Applebot-Extended, meta-externalagent, Bytespider. Search and AI
  answer crawlers stay allowed. Corrects the old Google-Extended
  comment: it does not affect Search or AI Overviews.
- e2e: assert the real headings and the header Services link (48/48)

docs/launch-checklist.md

@@ -28,7 +28,7 @@ Status legend: `[ ]` open · `[x]` done · `[?]` needs verification · 🛑 owne
 | Search | Google Search Console domain property verified; sitemap submitted and fetched by Googlebot |
 | Mail | MXroute. SPF pass, DKIM pass (selector `x`), DMARC `p=none` — mail-tester 9.5/10 |
 | `npm run build` / `typecheck` / `seo:lint` | green, 21 pages |
-| `npm run test:e2e` | 44 passed / 4 failed — stale assertions, see §2.1 |
+| `npm run test:e2e` | **48/48 green** |
 
 ### Traffic path
 ```
@@ -79,32 +79,21 @@ discovered 2026-10-23.
 - [ ] Durable fix in the `gitea` ansible role: disable live-restore on that VM, or restart the
       runner after dockerd restarts (systemd `PartOf=`/`ExecStartPost` hook).
 
-### 1.4 `/insights/` ships empty, with developer-facing copy 🛑
-`src/pages/insights/index.astro` shows two cards written for a developer ("Publishing path",
-"RSS support") and a hero calling the section a "Future publishing home". The section is in the
-primary nav with zero articles.
-- [ ] 🛑 Ship it or not.
-- [ ] If yes: delete both note-cards and rewrite the hero as reader-facing copy.
-- [ ] If no: drop it from the primary nav and exclude the route from the sitemap.
+### 1.4 `/insights/` ✅ 2026-10-23
+Now a reader-facing "Coming soon" page (hero + contact CTA); the developer-facing cards are gone.
+It stays in the nav. When the first real article lands, restore a listing on this page.
 
-### 1.5 Privacy policy review 🛑
-`/privacy/` went live 2026-10-23, drafted from what the site actually does (contact form via
-Formspree, Umami, GA4 with cookies, server/security logs).
-- [ ] 🛑 Owner review of the text. It is a legal document.
-- [ ] 🛑 Consent banner: GA4 sets cookies. Strictly, EU/UK visitors need opt-in consent; most
-      US-focused small-business sites run with a privacy policy only. Owner's call. Umami needs
-      neither.
-- Anything added to `src/components/Analytics.astro` must be disclosed on `/privacy/`.
+### 1.5 Privacy policy ✅ 2026-10-23
+`/privacy/` reviewed and accepted by the owner. No consent banner (owner's call).
+Anything added to `src/components/Analytics.astro` must be disclosed on `/privacy/`.
 
 ---
 
 ## 2. Should fix
 
-### 2.1 e2e suite is red — stale assertions, not a regression
-4 of 48 fail (2 tests × desktop/mobile). Both assert **copy the exact-copy work correctly removed**:
-- `tests/site.spec.ts:63` waits for a link named `Explore services`; the homepage CTA is `All services`.
-- `tests/site.spec.ts:93` waits for a heading matching `/Focused expertise/`, gone from `/focus-areas/`.
-- [ ] Update both tests to current copy; get back to green so the suite is trustworthy.
+### 2.1 e2e suite ✅ green 2026-10-23 — 48/48
+The stale assertions (invented copy removed by the exact-copy work) now check the real headings
+and use the header Services link; the homepage body has no direct `/services/` link.
 
 ### 2.2 Repo hygiene
 Commit `9f1cbca` committed ~50 `.playwright-mcp/` screenshots/snapshots plus a 2.8 MB
@@ -122,11 +111,13 @@ Commit `9f1cbca` committed ~50 `.playwright-mcp/` screenshots/snapshots plus a 2
 - [x] **Canonical host** — `www` (2026-10-23). Apex 301s via Traefik middleware in `k8s/ingress.yaml`.
 - [x] **Analytics** — Umami + GA4 side by side (2026-10-23).
 - [ ] 🛑 **Contact details** — confirm `804-332-6618` / `info@bluecapstrategies.com` are final.
-- [ ] 🛑 **AI training-bot policy** — `GPTBot` and `ClaudeBot` are **Allow: /** in
-      `public/robots.txt`, with a ready-to-uncomment `Disallow: /`. The site is now crawlable.
+- [x] **AI training-bot policy** — training crawlers blocked (2026-10-23): GPTBot, ClaudeBot,
+      Google-Extended, CCBot, Applebot-Extended, meta-externalagent, Bytespider. Search and
+      AI answer/search crawlers (Googlebot, Bingbot, OAI-SearchBot, Claude-SearchBot, …) stay allowed.
 - [ ] 🛑 **Brad Rodgers bio + credentials + portrait** — gates `Person` schema, the About
       buildout, and principal-led E-E-A-T/GEO positioning.
-- [ ] 🛑 **Real insights articles** — no fabricated or unreviewed AI content (see §1.4).
+- [ ] 🛑 **Real insights articles** — no fabricated or unreviewed AI content. `/insights/` is
+      "Coming soon" until the first one exists (§1.4).
 - [ ] 🛑 **Social profiles** — provide real profiles or omit the footer block.
 - [ ] 🛑 **Proof modules / representative engagements** — no fabricated client work.