write down that addresses are never localised

Localisation stops at the words around the content. No path segment is
translated: reserved segments stay `page` and `tags` in every language, page
numbers stay ASCII, and a variant is reached at the English key under its prefix.
The theme contract gains the matching rule — a URL, key or path segment must
never go through `t`, `num` or `day`.

This is already how the code behaves; every localisation function lives in
internal/render/chrome.go and the content package, which owns every URL, cannot
reach it. Recorded because nothing in the code says so out loud.

state.md now names the five frontmatter keys the parser actually lifts, so
content-model.md's table reads as the accepted format rather than a list of what
runs — `slug` in particular is unread today.

docs/state.md

@@ -25,6 +25,10 @@ Chrome text, dates and digits render in English or Bengali; authored text is unt
 smoothing (ADR-0034). This repo holds engine source only — the site root is external and passed with
 `-site` (ADR-0011).
 
+Frontmatter the parser lifts today: `title`, `date`, `tags`, `aliases`, `order`. Every other key in
+`content-model.md`'s table — including `slug`, `draft` and `type` — lands in `Extra` unread, so that table
+is the accepted format, not a list of what runs.
+
 Dependencies: three, all allowlisted — `goldmark`, `golang.org/x/text`, `gopkg.in/yaml.v3`.
 
 ## Counters — the earn-it authority