public/ is one folder again: drop the stale doxa-maps/ bundles a rebuild re-added, and make that a hard failure

d49b6c80 rebuilt four bundles under the OLD tree name after the rename to dx-maps (09014f8a), putting
public/doxa-maps/{big-picture,doxa-research-map,research-map-plus-grid,wall-of-people-groups}.js back
beside public/dx-maps/. Nothing references them (the live copies are under dx-maps/). Removed.

check:public-hygiene only WARNED about a root entry outside the drop-in contract unless run --strict, so
the build stayed green. public/ holding only the output folder + README.md is a Driver decision
(BUILD-OUTPUT-IS-ONE-FOLDER), so it is now always a finding. Proven both ways: with the orphans the gate
FAILS ('doxa-maps/ — outside the drop-in contract (dx-maps, README.md only)'); without them it passes.

internal/public-hygiene-check.mjs

@@ -199,7 +199,10 @@ const rootEntries = [...new Set(files.map(f => f.rel.split('/')[0]))].sort()
 for (const e of rootEntries) {
   if (CONTRACT.has(e)) continue
   const label = files.some(f => f.rel.startsWith(`${e}/`)) ? `${e}/` : e
-  hit(STRICT ? findings : warnings, 'contract', label, `outside the drop-in contract (${[...CONTRACT].join(', ')} only)`)
+  // ALWAYS a finding, not a strict-mode warning: public/ holding ONLY the output folder + README.md is a
+  // Driver decision (BUILD-OUTPUT-IS-ONE-FOLDER), not a style preference. MEASURED 2026-09-25: a rebuild
+  // under the OLD tree name re-added public/doxa-maps/ beside public/dx-maps/, and this gate only warned.
+  hit(findings, 'contract', label, `outside the drop-in contract (${[...CONTRACT].join(', ')} only)`)
 }
 
 // inventory