Write a startup's public page

Owner or operator, same two-layer gate as the read. Content auto-publishes with no per-post review, which is why the AGENT path additionally requires a SIGNATURE-ENFORCED token: a leaked bearer alone must be useless against a startup's public page. The Clerk session path is not subject to that (the human is the identity). Text fields are plain text defanged server-side; the repo ships no HTML sanitizer and this route accepts no HTML.