Challenge 1: Why AllowOverride None Everywhere Isn't a Contradiction —
Solution Walkthrough

Why it's not a contradiction:

Chapters 3 and 4 explained AllowOverride's named groups and what
.htaccess can do specifically because understanding what .htaccess
CAN do is exactly what's needed to make an informed decision about
whether it's actually needed for a given deployment -- not because
every real deployment is expected to use it. This capstone's scenario
explicitly states that both sites' configuration lives entirely in
version-controlled main config files, not scattered per-directory
overrides. Since neither site needs the specific thing .htaccess is
for -- letting someone without access to the main config make changes
-- AllowOverride None is the correct choice precisely BECAUSE of what
was learned in Chapter 3, not despite it. Chapter 3 itself named
AllowOverride None as a standard hardening recommendation "wherever
it isn't genuinely needed," and this scenario is exactly that case.

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise checks that the reader understands teaching a mechanism
in depth and recommending it be turned off are not in tension --
Chapter 3's own material is what makes it possible to correctly
judge that this specific deployment doesn't need .htaccess at all,
rather than leaving it on by default out of uncertainty.