Lock and seal closed runs; feedback with the closing form; Home headlines link to their sections; drop the back link

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

docs/run-spec.md

@@ -106,6 +106,20 @@ Rules the engine enforces:
 - **Modes** are `manual` and `auto-confirm`. Auto-confirm applies confirmation only; running the step's own
   command is a separate, later level ("auto-pilot with execution", RBT-WP-0006).
 
+## Closed runs are locked and sealed
+
+Closing a run (`finalize`) makes its record final:
+
+- **Locked.** A closed record cannot be saved with changes: the engine refuses, naming what would have changed. The only later update it
+  accepts is `exercise_recorded`, written by the legacy "Record pack as exercised" step. This holds for runs closed before sealing existed too.
+- **Feedback.** It locks with the run. Give it before closing, or with the closing form: `finalize(..., rating, comment)` records an optional
+  rating and comment together with the outcome (validated first, so a refused close changes nothing). This keeps abandoned and failed runs from
+  losing what the operator wanted to say.
+- **Sealed.** The record carries a SHA-256 `seal` of its content (excluding `seal`, `updated` and `exercise_recorded`), and the file is made
+  read-only. `seal_state` reports `open`, `sealed`, `broken` (changed outside the app after closing) or `unsealed` (closed before sealing existed).
+  A broken seal is called out in the UI, and such a run no longer counts as maturity evidence. This is tamper-evidence, not prevention: someone
+  with file access can still edit a file, but not without being noticed.
+
 ## Changing a value after steps used it
 
 A v0.1 run fixes its parameters when it starts. In a v0.2 run datapoints can be edited (guided flow questions, data view), but a value