[Madraka]

RFC-0043 rollout PR 2 (§1.10, static builds). Part of the self-host work behind #150. The rebuild-on-publish hook comes in a separate PR after this one.

What changes

• cloudhal build --published builds the published snapshot only (resolvePublishedBuild in snapshot.ts).
  • With nothing published, it writes the not-published status page as the whole output (commands/build-status.ts), without an Astro run:
    • index.html and 404.html, from statusPageHtml (@cloudhal/astro-renderer/status-page) in the site's default locale, with the site's name and no logo or theme tokens (§1.6);
    • robots.txt with Disallow: /;
    • _headers with no-store, noindex and the status CSP;
    • a .cloudhal-status marker that holds the state.
  • The build prints the state it wrote.
  • A published pointer to a missing snapshot throws. It is never treated as "not published".
  • --published --snapshot is refused.
  • @cloudhal/cli now depends on @cloudhal/astro-renderer directly. It was already in the tree through @cloudhal/cloudflare.
• Plain cloudhal build is unchanged: published, then latest, then a fresh snapshot. This is documented in --help (the CLI reference) and in the guide. A typed overload keeps build()'s return type for existing callers.
• deploy/docker/bin/site-build passes --published and says when it published the status page.
• deploy/docker/Caddyfile: an @status matcher (file /.cloudhal-status, not /robots.txt) rewrites to /index.html and serves it with file_server { status 503 }. It sends Retry-After: 3600, Cache-Control: no-store, X-Robots-Tag: noindex, X-Cloudhal-State, the CSP, nosniff and no-referrer. The existing caddy validate step covers it.
• docs/guides/self-host.md: the latest-snapshot caveat is gone. A new "Before the first publish" paragraph has the header table, a recipe for other web servers, and a note that the theme's statusPage hook does not run in a static build. The upgrade step mentions the new Caddyfile.

Tests

• packages/cli/test/build-published.test.ts:
  • the status output: files, the tr locale, the English fallback, and a symlinked dist that is removed rather than followed;
  • a spawned build --published before a publish: status page, no snapshot created, no drafts;
  • a spawned build after a publish: the site, no marker;
  • --snapshot refused.
• scripts/docker-smoke.ts:
  • site-build before the first publish, which also covers the 0.6.3 legacy move;
  • the compose Caddyfile run in caddy:2.11 on the container's volume: / and deep paths answer 503 with Retry-After: 3600, no-store and noindex, and robots.txt answers 200;
  • after the publish, 200 with the home page and no marker;
  • a third build checks the swap and that the previous build is kept.
• Local results:
  • CLI suite: 65 files and 453 tests, all passing;
  • apps/docs repo-docs test passes;
  • biome, size check and typecheck are clean;
  • the Caddyfile was validated and served with local Caddy 2.11.9: 503 on pages, 200 on robots.txt, 200 once current points at a real build.
• Not run locally: the image build and the docker smoke test. The Docker workflow runs both on this PR.

Patch changeset for @cloudhal/cli.

🤖 Generated with Claude Code