Kill hosted CTA — self-host is the shipping path; add live-demo secondary

The Hosted / Sign up free CTA pointed at app.aegistraces.com (never
provisioned) and represented a product mode we haven't built (multi-
tenant SaaS cockpit). Removing it prevents users from clicking into
a dead end and clarifies the positioning: AEGIS is a self-hosted
security tool, downloadable today, license-key gated for paid
features.

Replaced with a "Try live demo →" secondary CTA pointing at
demo.aegistraces.com — real Cockpit UI running in read-only mock
mode. Domain will resolve once the demo deployment lands (separate
work; see below).

Also promoted Download to primary (bold black button) so the
one-click-to-value path is unmistakable.

Changed pages:
- index.astro (hero + closing CTA)
- tour.astro (final CTA)
- pricing.astro (top of pricing page)