feat(orchestrator)!: S0 English everywhere, Sécurité, NATO hashes, ICAO digits

Requirement 001 phase 6, S0:

- Speech: the security class shows as "Sécurité" and is spoken as in
  maritime radio, "say-cure-ee-tay" three times. A hex run of 7 or more
  characters with a letter and a digit (commit, session, message ids) is
  spelled in the NATO alphabet; every other digit is spoken on its own
  in ICAO pronunciation (42305: four two tree zero fife). The spelling
  runs inside clip() before the length cut, so a phrase still fits
  SPEECH_LIMIT; the displayed text keeps its digits and hashes.
- English: every orchestrator label, tooltip, message, error, script
  output, document and test string is English (Regeln -> Firewall,
  Hierarchie -> Hierarchy, Steuerung -> Controls, Ausführen -> Run, ...);
  the page declares lang="en" and formats dates as en-GB. Task filter
  ids are English. German stays only in the skill trigger phrases that
  quote the operator, and as identifiers: the view keys (view=) and the
  leitstand id.
- tests/test_english.py scans every tracked text file for umlauts and
  German words, with an allowlist of the quoted trigger phrases.

BREAKING CHANGE: the Stream search tokens art: and seit: are now kind:
and since:; an old art: or seit: token counts as a plain word.

Evidence: make test 657 OK, ruff and markdownlint clean
(/tmp/s0-make-test-1.log); e2e 17 OK, none skipped (/tmp/s0-e2e-1.log);
MEDUSA 86 files, 24 findings on reworded strings accepted after an
independent skeptic (21 path:line, 0 rejected, no behaviour change in
signing, approving, rules, denying, offices, events), rescan 0 open.

🎯 Fix: 93 %
💥 Break: 4 %
💸 Cost: 100 %
⏱️ Time: –
🛡️ Security: 100 %
🏆 Score: 89
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_hub_deny.py

@@ -80,9 +80,9 @@ class TestHubDeny(HubCase):
         denial = self.httpd.hub.messages.get(message_id)["denial"]
         self.httpd.hub.messages.change(message_id, {"denial": {**denial, "reason": "push anyway"}})
         self.assertTrue(self.tool("operator_message", {"id": message_id, "text": told, "to": "Skills session"})["isError"])
-        logged = [row for row in self.events("kinds=approval")["events"] if row["title"].startswith("Ablehnung ask")]
+        logged = [row for row in self.events("kinds=approval")["events"] if row["title"].startswith("Denial ask")]
         self.assertEqual(len(logged), 1)
-        self.assertIn("call an Skills session", logged[0]["text"])
+        self.assertIn("call to Skills session", logged[0]["text"])
         self.assertNotIn(ask_id, [item["id"] for item in self.snapshot()["inbox"]])
 
     def test_every_class_but_mayday_reaches_the_agent_or_all(self):
@@ -121,7 +121,7 @@ class TestHubDeny(HubCase):
         self.assertTrue(self.radio()[0][-1].endswith("Denied by the operator: operator command git push in /repo (from Skills). Reason: push after the review"), self.radio()[0])
         self.assertEqual(len(self.radio()), 1)
         texts = [row["text"] for row in self.events("kinds=approval")["events"]]
-        self.assertTrue(any("kein Empfänger" in text for text in texts), texts)
+        self.assertTrue(any("no recipient" in text for text in texts), texts)
 
     def test_a_forged_denial_is_refused_before_anything_is_stored_or_sent(self):
         self.claim("s1", "Skills session")
@@ -134,7 +134,7 @@ class TestHubDeny(HubCase):
             with self.subTest(name=name), mock.patch.object(batches, "UNDO", 0.05):
                 status, _, body = self.approve(entries, proof)
                 self.assertEqual(status, 400, body)
-                self.assertIn("nicht signiert", body.decode())
+                self.assertIn("not signed", body.decode())
                 self.assertFalse(self.httpd.hub.batches.holds("ask", ask_id))
         time.sleep(0.2)
         self.assertEqual((self.ask_status(ask_id, "0"), self.radio()), ("pending", []))
@@ -182,7 +182,7 @@ class TestHubDeny(HubCase):
         self.assertEqual(self.prepare([entry])["payload"]["items"], [signing.item_hash(signing.denial_item(subject, "call", "not now", ""))])
         with mock.patch.object(batches, "UNDO", 0.05):
             self.assertEqual(self.approve([entry], self.signed([entry], self.pin()))[0], 202)
-            self.settle(lambda: any("kein Empfänger" in row["text"] for row in self.events("kinds=approval")["events"]))
+            self.settle(lambda: any("no recipient" in row["text"] for row in self.events("kinds=approval")["events"]))
         self.assertEqual((self.ask_status(ask_id, "0"), self.radio()), ("denied", []))
 
     def answer(self, signer: Key, item: dict, channel: str, reason: str) -> dict: