Freenet-published mirror ships ~292 broken references (264 of them a script 404 on every page)

[sanity]

The site published to the Freenet contract by publish-freenet.yml is not the same artifact as the
one on GitHub Pages: cargo make build-freenet deletes directories that need a server, but the
pages referencing them are kept. The result is a large number of 404s that only affect the
Freenet-hosted copy.

Found while adding scripts/check-links.py in #103. That check gates the source build, so it
does not catch this — filing separately rather than widening that PR.

Reproduction

FREENET_CONTRACT_KEY=testkey cargo make build-freenet
# stage it so /v1/contract/web/testkey/... resolves against the tree root
mkdir -p /tmp/fnstage/v1/contract/web
cp -r target/freenet-site /tmp/fnstage/v1/contract/web/testkey
python3 scripts/check-links.py /tmp/fnstage

→ 300 broken internal link(s) across 161 page(s). About 8 are artifacts (content that links to
https://freenet.org/... absolutely, which the checker treats as internal), leaving ~292 real ones.

Breakdown

Count	Target	Cause
264	/js/nacl.min.js, /js/nacl-util.min.js, /js/cbor.min.js (88 pages each)	Makefile.toml build-freenet rm -fs them, but they are referenced by <script src> in the shared template, so every page of the contract site requests three scripts that 404
~20	/slides/** assets (.svg, .png, .webm)	rm -rf "$OUT/slides", but /presentations/2026-02-06-freenet-lives/ and /presentations/2026-07-17-apps-without-platforms/ are kept and embed those assets
2	/img/ghost-key-illustration.webp	rm -f'd, still referenced from /about/news/ and the ghost-keys post
1	/ghostkey/create/	rm -rf "$OUT/ghostkey", still linked from the ghost-keys post body

scripts/rewrite-paths.py already strips /ghostkey/ links from the nav for exactly this reason —
it just does not cover the script tags, the slide assets, or in-body links.

Options

Whichever is preferred:

• Strip or no-op the references at the same time as the files, extending the approach
  rewrite-paths.py already takes for the nav.
• Keep the files. The three JS libraries are small and static; if they are only deleted because
  they were assumed to be ghost-key-only, keeping them costs little and removes 264 of the 292.
• Drop the pages whose assets are removed (/presentations/*) from the contract build, so nothing
  references what is gone.

Once the output is clean, check-links.py could gate it directly instead of gating a proxy build,
which would also close the gap noted in #103 where the checked build is not the published one.

[AI-assisted - Claude]