feat(river): orient hero around Signal/WhatsApp familiarity; nonprofit trust strip

[sanity]

Problem

The /river landing page led with a "no company in the middle" contrast but didn't leverage the thing new users already know. Steven feedback: orient River in the positive category of global familiarity (Signal / WhatsApp) so newcomers have a mental anchor — without overclaiming encryption parity (Signal's double-ratchet forward/backward secrecy is real and River doesn't match it; claiming "privacy of Signal" would invite a pedantic nerd-debate and would be dishonest).

Approach

Differentiate on architecture and control, never on encryption:

• Hero now leads with familiarity: "Group chat you already know. / Without the company in the middle." Subhead references Signal/WhatsApp, then pivots to Freenet ("a global network nobody controls"). New punch line: "No account. No phone number. No one in the middle. Just you." (The old "no account, no phone number" reassure tick was folded into the punch line.)
• Comparison reframed onto one honest axis — everyone else runs on servers someone controls. Names WhatsApp and Signal, credits their encryption, and stays fair to Signal (credited as a nonprofit — Signal Foundation is a 501(c)(3) — not "a company"). The section intro carries the structural argument ("any single operator can be pressured … it doesn't take bad intent, just one point everyone has to trust"), so the Signal row stays short and factual. Nostr and Briar/Tox rows dropped to keep the servers-control message clean.
• Trust strip added: "Built by a nonprofit, not an ad company" — Freenet Project Inc, a 501(c)(3). Framed on motive (no ads, no investors, no business that runs on your data), not on data-collection, to stay consistent with the page's alpha/telemetry disclosure.
• CSS: .rv-h1-2 (smaller 2nd H1 line), .rv-punch, .rv-trust*; .rv-sub measure widened 36ch→44ch.

Testing

• hugo build clean; rendered /river/index.html verified to contain all new copy and none of the replaced copy.
• Copy reviewed word-by-word by Ian, plus ChatGPT and Grok on earlier rounds.
• Review pass on this diff: Codex (external) — clean, no functional/build/maintainability issues. Adversarial Claude read — no BLOCKER/SHOULD-FIX; verified no orphan CSS classes, all var() tokens resolve, dark-mode tokens remapped, HTML/section nesting balanced, no overflow risk, template partials intact. Two copy NITs, both dismissed with justification (standard P2P "no servers" phrasing; deliberate no-encryption-parity design).

Copy-only change to two Hugo templates (HTML + scoped CSS). No logic, no wire format, no high-risk surface.

[AI-assisted - Claude]