docs: publish SMS policy and consent pages

[xnoto]

Summary

Adds public, direct-path policy pages for a future Twilio A2P Campaign submission:

• sms.html documents the optional, limited developer/support SMS program, direct affirmative consent, message frequency, rates, STOP opt-out, and support contact.
• privacy.html and terms.html state the corresponding mobile-number and messaging-consent non-sharing commitment.
• legal.css gives the standalone pages an accessible shared presentation.
• sitemap.xml publishes the three canonical HTTPS URLs.

The pages do not create a public enrollment flow, do not claim that A2P registration is complete, and avoid an unsupported automatic HELP-response promise. This is an A2P documentation prerequisite only; it does not change the SMS bridge, Twilio configuration, sender selection, or runtime behavior.

Fixes # — not applicable; owner-approved A2P Campaign documentation prerequisite.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — static-checks passed on commit 131c0fc5b857ef9eac52aade7a3fee5fbd94b731.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — not applicable; this is source-only static HTML, CSS, and sitemap content.

Adversarial content review found unsupported HELP claims and an inaccurate homepage sitemap lastmod; both were corrected before this PR. PR CI ran pre-commit, including gitleaks and Prettier, plus unchanged service-worker syntax validation. It does not validate policy wording, HTML/CSS rendering, or sitemap XML semantics; those are deliberately recorded here as post-merge public-verification checks.

No local OpenTofu or other validation commands are claimed.

Impact and rollout

Self-contained in makeitworkcloud/www; no producer/consumer, pin, generated-copy, service-worker, workflow, bridge, or Twilio-account change. After an owner-approved merge, the existing deploy.yml automatically validates, syncs the static site to S3 with --delete, and purges Cloudflare. Public availability of the direct .html URLs must be verified separately after deployment. Rollback is a revert followed by the same automatic deployment.

Manual A2P Brand/Campaign registration and approved sender association remain separate owner-console actions. The future GitOps switch to the Messaging Service sender mode is unchanged and remains confirmation-gated.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

This change was materially produced by an AI agent under owner direction.