Development record

docs/requirements.txt pins mkdocs-material by version only; the deploy render job runs pip without hash-pinning, so a --require-hashes freeze is the remaining supply-chain hardening