Census: db region forward copy (Luna's approved copy, 2026-10-23)

Status: ACCEPTED by the census owner on #280, 2026-10-23, as census-ruling-db-region-forward-copy. The owner's rationale: two envelope re-pins from string and doc edits, with no new reads or writes.

Branch db-region-forward-copy, cut from main at 6e8564ad. It applies Luna's copy verdicts for the forwarded db read (fourteen approved as drafted, seven rewritten: DBF-3, DBF-4, DBF-9, DBF-13, DBF-30, DBF-31, DBF-32), moves every DBF row to dbForwardCopyBuilt, and writes DBF-30 and DBF-31 into docs/site/cli.md.

The code change is string constants only: five sentence constants in dbforward.go (the CLI) and one in internal/console/apidbforward.go, plus their comments. No read is added, removed or changed, and no census unit's digest moves.

Root-read census: one overlay, internal/provision/testdata/plan14-root-reads-db-region-forward-copy.tsv, loaded last after plans-3a-creation-caps, holding only two envelope re-pins:

| envelope | why | |---|---| | . | dbforward.go's DBF-3, DBF-4, DBF-13 and DBF-32 constants | | internal/console | apidbforward.go's DBF-9 constant |

The legacy seal does not move (dc7dbb4f562fe31556e7ed1e09fcfb380f551b45a444e94e72662f0b202c605b, checked before the overlay loads and after it).

Record-write census (9B8): unchanged. Claim routes: unchanged. go.mod: unchanged.