Post-merge follow-ups from the NVDA accessibility remediation

## Issue Description

Four follow-ups were recorded when PR #2934 merged. This issue tracks them together. Three are repairs; one is a disposition recorded so it is not mistaken for unfinished work.

PR #2934 is referenced only as the origin of these items. Its review findings are closed and are not reopened here.

## 1. OWASP citations are dead (repair)

OWASP restructured its site from `owasp.org/www-project-` to `owasp.org/projects/`. The repository contains 8 distinct legacy URLs across 17 files, concentrated in the OWASP security skills.

Two are confirmed 404:

- `https://owasp.org/www-project-top-10-ci-cd-security-risks/`
- `https://owasp.org/www-project-ai-security-and-privacy-guide/`

The remaining six are unverified, not known-good. The CI link check runs with `changed-files-only: true` and `soft-fail: true`, so it neither inspects nor blocks on files that rarely change.

**Done when:** every one of the 8 URLs has been individually checked, each replacement is confirmed to resolve *and* to be the same OWASP project the original cited, and any URL without a confirmed replacement is left unchanged and listed here as a named exception. No slug is inferred from a pattern.

## 2. Word-stem dictionary is oversized and its rationale is false (repair)

`.cspell/word-stems.txt` holds 139 fragments. Its header claims a stem such as `compl` accepts any token beginning with it. That is false: a probe of `validatxyz complzzz conformaqqq` reports all three as unknown words. cspell matches whole words here.

The entries also do not share one origin. At least three sources exist:

- truncated generated grader names, for example `...-signal-compl-a5d0ffac`
- hand-authored identifiers, for example `per-stim` in `docs/contributing/evals-ci.md` and `prereq.json` in the accessibility runbook
- hand-authored regex fragments, for example `(?is)(revalidat|validat|check)` in `evals/agent-behavior/stimuli/code-review.yml`

Because of that, the file cannot simply be deleted, and renaming graders would not help: the truncated names are committed identities pinned by `evals/migrations/vally-0.16-grader-name-aliases.json`, so regenerating them would register as lineage drift.

**Done when:** every entry is attributed to its actual source, entries with no remaining occurrence are removed, generated-name entries are covered by a scoping mechanism, genuinely hand-authored entries are retained, the header states something true, and a deliberate typo in ordinary prose is still reported.

## 3. Announcement coalescing has no runtime evidence (repair)

Walkthrough step announcements are coalesced behind a 150 ms settle timer so a superseded step does not speak. Both the shipped and starter decks implement it and both assert it only in source text. `docs/docusaurus/e2e/slides.spec.ts` asserts slide-change announcements only.

This is the behavior most likely to regress silently, because it is timing-dependent.

**Done when:** a browser assertion advances the walkthrough faster than the settle delay and observes a single settled announcement, and that assertion is proven to fail when the timer is removed rather than assumed to work.

## 4. `_intent.py` POSIX gate: no change proposed (disposition)

`_require_secure_write_support` requires POSIX `dir_fd`, `O_DIRECTORY`, and `O_NOFOLLOW`, so 49 of 84 tests in `test_intent.py` fail on Windows locally.

**This is not a coverage gap.** The `Python Tests (.github/skills/accessibility/accessibility)` lane runs on Linux and reported `600 passed`, which reconciles exactly with the 516 that run locally plus the 84 intent tests. CI executes all of them.

Relaxing the precondition would weaken a deliberate security control for local convenience. Recorded here so the earlier "49 tests unexecuted" note is not misread as missing coverage.

**Disposition:** no change proposed. Close this item with the record, not a fix.

## Additional Context

- Also open, and not yet dispositioned: `https://aka.ms/opensource/moderation-support` in `CODE_OF_CONDUCT.md` returned a connection failure rather than a 404 during a local link check. It needs a retest before anyone concludes it is broken.
- Whether citation-bearing skill and instruction files should be link-checked on a schedule, or without the changed-files restriction, is an open question rather than a decided change.