feat(05-05): ?fixpair harness knob + pinned-corpus origin lookup (GREEN)

- route-profiles.ts: HARNESS-ONLY module — sentinel ROUTE_PROFILE_HARNESS_ONLY
  + getRouteProfileOrigin wrapping getPairOrigin; D-12 header (pinned PUBLIC
  origin only, no coordinate params) + BA5 exclusion note
- index.html: ?fixpair=<pair-id> knob resolves the pair's pinned public
  origin as the mock's telegramFix (accuracy 12, heading null); unknown
  pairId keeps the default fix; knob documented in the profile comment
- [Rule 1 - Bug] main.ts never passed bootMap's opts.onLoad — route sources
  never existed and setRouteDrawn's setData silently no-op'd (cards rendered,
  the line never painted; invisible to the RS fakes). Wiring added + RS2
  boot-wiring gate pins it
- [Rule 1 - Bug] consult raced the map load: harness session stubs resolve
  the location chain before WebGL/style init, so draw landed on missing
  sources and the post-load empty install discarded it (probe: ROUTE token
  fired before RAMS-BASEMAP-READY). Consult now awaits mapLayersReady,
  resolved in the load handler after installRouteLayers (never wedges —
  finally-resolved; cards-only boots resolve immediately)
- Capture run: CAPTURE OK — 13/13; route line verified painted, alt swap
  renders ROUTE 2/2 +1 MIN VS ROUTE 1, pending card honest, dark PX-02
- npm test -w web: 76 passed (new RS2 boot-wiring gate included)

web/index.html

@@ -9,7 +9,7 @@
 <body>
   <div id="app"></div>
   <script type="module">
-    /* D-11 Mock-Telegram profile: ?mock=android|ios|tdesktop|macos|web  +  ?scheme=light|dark  +  ?pin=1  +  ?locale=en|ms  +  ?fixdelay  +  ?sessiondelay  +  ?dest=<id>
+    /* D-11 Mock-Telegram profile: ?mock=android|ios|tdesktop|macos|web  +  ?scheme=light|dark  +  ?pin=1  +  ?locale=en|ms  +  ?fixdelay  +  ?sessiondelay  +  ?dest=<id>  +  ?fixpair=<pair-id>
        Harness-only: served from web/dist-harness, never deployed.
        The WHOLE block below is inside `if (__ARAHARAH_HARNESS__)` — Vite's `define`
        replaces that identifier with `false` in the production build, so the branch is
@@ -38,6 +38,22 @@
       const sessionDelayMs = Number.parseInt(q.get("sessiondelay") || "0", 10);
       const fixDelayMs = Number.parseInt(q.get("fixdelay") || "0", 10);
 
+      /* The 05-05 route profile (?fixpair=<pair-id>): the mock's Telegram fix
+       * becomes the PAIR'S PINNED PUBLIC ORIGIN, resolved from the committed
+       * fixture corpus through the harness-only route-profiles module (D-12 —
+       * the harness introduces no user coordinate; a ?lat/?lng knob is
+       * deliberately absent). An unknown pairId keeps the default fix — the
+       * boot must never wedge. The dynamic import lives inside this
+       * __ARAHARAH_HARNESS__ branch, so production dead-code-eliminates the
+       * module (BA5 greps web/dist for its sentinel). */
+      const fixpair = q.get("fixpair");
+      let telegramFix = { lat: 3.1513, lng: 101.6958, accuracyM: 12, headingDeg: null };
+      if (fixpair) {
+        const { getRouteProfileOrigin } = await import("/src/mock/route-profiles.ts");
+        const origin = getRouteProfileOrigin(fixpair);
+        if (origin) telegramFix = { lat: origin.lat, lng: origin.lng, accuracyM: 12, headingDeg: null };
+      }
+
       // Set BEFORE main.ts is imported — this is the marker main.ts's install guard checks.
       window.__ARAHARAH_MOCK__ = { profile, scheme, locale, dest };
 
@@ -73,7 +89,7 @@
         languageCode: locale,
         grantLocation: profile !== "tdesktop",
         deliveryDelayMs: fixDelayMs > 0 ? fixDelayMs : undefined,
-        telegramFix: { lat: 3.1513, lng: 101.6958, accuracyM: 12, headingDeg: null },
+        telegramFix,
         startParam: dest ?? undefined,
       });
     }