write down that addresses are never localised

Localisation stops at the words around the content. No path segment is
translated: reserved segments stay `page` and `tags` in every language, page
numbers stay ASCII, and a variant is reached at the English key under its prefix.
The theme contract gains the matching rule — a URL, key or path segment must
never go through `t`, `num` or `day`.

This is already how the code behaves; every localisation function lives in
internal/render/chrome.go and the content package, which owns every URL, cannot
reach it. Recorded because nothing in the code says so out loud.

state.md now names the five frontmatter keys the parser actually lifts, so
content-model.md's table reads as the accepted format rather than a list of what
runs — `slug` in particular is unread today.

docs/theme-contract.md

@@ -65,9 +65,10 @@ Phrase keys today: `newer`, `older`, `empty`, `page-of` (two arguments), `positi
 unknown language falls back to the default locale and an unknown key returns itself, so a missing
 translation can never blank a page or fail a render.
 
-Two rules a theme must keep: put the machine-readable form in the attribute and the localised form in the
-text — `<time datetime="{{.Date.Format "2006-01-02"}}">{{day .Lang .Date}}</time>` — and never localise
-`.Title`, `.HTML` or anything else the author wrote.
+Three rules a theme must keep: put the machine-readable form in the attribute and the localised form in the
+text — `<time datetime="{{.Date.Format "2006-01-02"}}">{{day .Lang .Date}}</time>`; never localise
+`.Title`, `.HTML` or anything else the author wrote; and never pass a URL, key or path segment through
+these functions. An address is not chrome (`content-model.md`).
 
 A site root cannot add or override a phrase yet. A theme needing its own words writes them in its own
 block; site-supplied strings wait for the settings cascade (`ideas/deferred-decisions.md`).