[Madraka]

Closes #150 (PR B of the #150 plan; PR A was #198).

With CLOUDHAL_SITE_BUILD=on (the Docker image's default) cloudhal studio runs the image's site-build --wait in a child process at start
and after every member of the onPublished family: the API publish route,
MCP publishes, approvals, rollbacks (the store's onPublished, now an
openLocalStore option) and RFC-0008 release runs (a new
ScheduledTickOptions.onReleasePublished, called after a committed
release's purge, in core-ts release-after.ts).

• site-rebuild.ts is the queue. A burst builds once (3 s after the last
  publish, at most 60 s after the first). Two builds never overlap, and
  requests during a build give exactly one more. A failure is recorded,
  never retried in a loop; the next publish tries again.
• site-build-run.ts runs the child, reads the rendered snapshot or the
  status page from cloudhal build --published's output with line
  scans, and writes a site.build audit row: system actor, duration,
  snapshot, the output tail on failure.
• site-build --wait waits up to 30 min for the lock
  (/tmp/site-build.lock) that cron and hand-started runs take, so builds
  never overlap across processes. Studio runs the start-up build in its
  own queue. The entrypoint runs it only for a CLI whose help does not
  name CLOUDHAL_SITE_BUILD (older CLOUDHAL_VERSION backfills).
• GET /api/sites/:id/site-build (site:read) reports the queue state and
  the last build. Studio's site overview shows a "Public site build"
  card (Kumo SectionCard, Badge, Banner, Code), and Activity labels the
  row "Build public site". The i18n keys were added in en and drafted
  for every other language through i18n:export/import (AI drafts
  awaiting review).
• CLOUDHAL_SITE_BUILD=off turns the start-up build and the rebuild on
  publish off. A plain cloudhal studio defaults to off and stays off,
  with a warning, when no site-build is on PATH. Dockerfile, compose,
  .env.example and the self-host guide document it; cron becomes an
  optional fallback for publishes from other processes.

Tests:

• site-rebuild.test.ts: debounce, max wait, serialisation, failure and
  retry, stop;
• site-build-run.test.ts: the setting, PATH, output parsing (linear on
  100k characters), child failures, the audit row;
• studio-site-build.test.ts: through the real Node publish path, with
  the start-up build, a burst, a rollback and a failed build retried;
• testing-releases.ts: the release hook on SQLite and D1;
• site-build-card.test.tsx: the Studio card;
• docker-smoke.ts: Studio's start and publish builds, as reported by the
  API, and a failed build that keeps site/current.

Test plan

• CI: lint, typecheck, vitest (Node 24 + 26), Rust, drift, CodeQL
• docker-smoke: start-up build, publish build, failed build keeps site/current
• Independent review (queue, lock, publish family, API scope, Studio card, i18n)

🤖 Generated with Claude Code