feat(site): generate localized static routes

[deku2026]

WIP checkpoint — not ready for final review or integration

WEB.01 is outside the current launcher scope. This checkpoint is retained at the root coordinator's direction; do not treat it as final delivery, approve it, or merge it. Final hosted checks, exact-head review, integration, publication, and ledger work are not authorized as part of this checkpoint.

Summary

• Add deterministic /, /hello/, /cloud-hello/ and English locale route/metadata/sitemap/redirect generation, using test-only version/locale fixtures; generated redirects remain an app-local artifact until the existing deployment boundary activates them.
• Preserve staging noindex/promotion behavior; candidate output is intentionally non-indexable until the existing promotion boundary. No Worker, production indexing, or Play publishing claim is made.
• Bind the exact browser-resource graph/templates in immutable browser-resources-r8; synchronize the authorized dependency/provenance receipts and verify CSP across every generated HTML member, with localized-script and tamper regressions.

WIP checkpoint changes

• Replace the CodeQL-flagged script-stripping regex in apps/site/tests/site-manifest.test.ts with exact emitted-anchor position assertions proving the hello navigation link appears before the first script.
• Add tests/provenance/candidate.test.ts positive/negative checks against the real .gitleaks.toml and r8 profile: exactly 8 observed profile rows, 6 unique path/digest bindings over the five approved public source paths, exact profile path and generic-api-key/AND/line scope, plus changed-digest/path/profile and credential-negative cases.
• No runtime/product behavior or dependency changes. The immutable r8 profile/record, dependency policy/receipt, and provenance metadata remain byte-identical to the prior checkpoint.

Evidence at exact checkpoint head

• WEB.01 epoch 1 (af-20260928-p04); branch task/web-01; base cd65b035c85532cd4c0467d31ac90e1006d8fa9a; exact WIP head 76b79e1a2541c46eed41f6df27bce232566d565f.
• Pinned Node 24.21.0 / npm 11.19.0 npm run check: passed (dependency tests 15/15, Vitest 66/66, provenance tests 42/42, policy, format, lint, and typecheck).
• On the clean exact head, two normal candidate build/verify/test cycles passed; tests/provenance/candidate.test.ts passed 23/23 each cycle. All 67 candidate files had identical relative paths and SHA-256 across both cycles; aggregate sorted path/hash snapshot SHA-256: 9dbde51b46ab679de1567d8e5ba25a6f6b248c119644057df0fc4e9a9d25b83d.
• git diff --check: passed; checkpoint commit changes only the two test files above.
• The prior hosted checks (including Gitleaks and CodeQL) were for head a3bf1f4bb23f4011a6dcbc8d06b326fcfde58e58 and do not validate this checkpoint. New hosted checks and an independent exact-head review remain outstanding; no local pinned Gitleaks scan result is claimed for this head.
• The local clean-head candidate window passed, but final delivery validation is incomplete: this is only a WIP checkpoint, with no final hosted disposition, review, merge, publication, or ledger completion.