Pin portal v0.2.3 - attended-bucket lint, first-nav fix; document the rule

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -18,7 +18,7 @@ on:
       - .gitea/workflows/deploy.yml
 
 env:
-  PORTAL_RELEASE: v0.2.2
+  PORTAL_RELEASE: v0.2.3
   INSTANCE: uhhm-portal
 
 jobs:

README.md

@@ -212,6 +212,13 @@ review resource's transitions — fireable by whoever holds one specific
 record's `?chain=` link plus its matching email (the unsubscribe
 pattern).
 
+**Attended buckets** (lint-enforced): every `record_as` bucket must be
+read by some `kv` resource in this repo (a desk or listing) — or its
+`aggregates.yaml` entry must carry `attended_by: <who/what consumes
+it>` naming the automation that does. A bucket nothing reads fails
+lint, so no publicly collected answer can land where no one will ever
+see it.
+
 ## Routing: the tree is the router
 
 The `questions/` directory tree is the URL tree — `index.yaml` names