fix: retarget Receipts host from receipts.liminate.dev to liminate.dev

[rmichaelthomas]

Why

Receipts was consolidated from the receipts.liminate.dev subdomain onto the apex liminate.dev (single deployment, per the liminate-dev backend). The subdomain no longer resolves — CI's non-blocking live-roundtrip was already failing on DNS against it.

API paths are unchanged at the app root (/save, /api/v1/export, /keys, /c/<id>); the product UI now lives at liminate.dev/receipts.

Old	New
receipts.liminate.dev (UI)	liminate.dev/receipts
receipts.liminate.dev/save	liminate.dev/save
receipts.liminate.dev/api/v1/export	liminate.dev/api/v1/export
receipts.liminate.dev/keys	liminate.dev/keys
receipts.liminate.dev/c/<id>	liminate.dev/c/<id>

The live fix (not just the benchmark)

The merged contract-lifecycle helper hardcoded the dead host in SAVE_URL / RECEIPTS_BASE, so the consent-gated upload path was POSTing a Bearer token to a host that no longer resolves. That's the load-bearing change here. Added a test pinning the constants to liminate.dev and a guard that the helper source carries no dead subdomain.

Full sweep (10 files)

helper/contract_lifecycle.py, references/save-procedure.md, SKILL.md, README.md, helper/README.md, docs/LOCAL-ONLY.md, docs/TRUST-BOUNDARY.md, .github/workflows/bench.yml (step name), benchmarks/bench_list_seeding.py (endpoint), tests/test_contract_lifecycle.py.

Care taken:

• Bare UI references → liminate.dev/receipts; path references → just drop the subdomain.
• TRUST-BOUNDARY ASCII diagram retargeted with box alignment preserved.
• TRUST-BOUNDARY dated provenance footer keeps the historical receipts.liminate.dev name with a "since consolidated to liminate.dev" note — history not rewritten.
• liminate-site is superseded by liminate-dev, so it's out of scope here.

Tests

• Full suite: 35 passed (adds test_helper_targets_the_current_receipts_host, test_helper_has_no_dead_receipts_subdomain).
• Hook shell test: pass. Blocking benchmark static check: pass.

🤖 Generated with Claude Code