feat(builder): produce Static Web Bundle v1

[Koh0920]

Summary

• strict ato.static-web-manifest/v1 and ato.static-web-bundle-receipt/v1 Rust contracts
• deterministic connect_src policy, fixed v1 frame ancestors, bounded extraction, and runtime-secret-canary terminology
• read-only StaticWebOutputPlan extraction and immutable bundle production only; no builder loop wiring

Contract provenance

• Worker contract: ato-contents refactor(ato-cli): unify provision dependency-root resolver #3, merge ce10d7350e2bd75173d5b3f12ad52331aa71eaab
• manifest and receipt JCS golden fixtures, including astral Unicode UTF-16 object-key ordering
• R2 key, host label, receipt digest, blob metadata, and manifest binding are re-derived and checked

Hardening

• unique ASCII-sorted connect_src
• fixed ordered frame-ancestor policy
• file/directory/depth limits and immutable receipt inventory
• runtime secret canary scanning (not a generic secret scan claim)

Rebase onto main

Rebased from the merged feat/surface-activation-v2 base (PR #1231) onto current main. The Vite production image-build lane landed via #1231; this PR is now a pure producer + contract PR with no builder-loop, R2, KV, route, or live mutation.

Scope

No R2/API/DB/Cloudflare deployment, route, KV, or live mutation.

Validation

The branch runs full capsule/snapshot-builder tests and all-targets Clippy locally; GitHub CI runs on the current head.