Phase 2: Mode A static site — build, serve, search, stage panel

One Go binary serves a pre-rendered site. No Node, no bundler, no node_modules:
htmx and the SSE extension are vendored files, Markdown and code highlighting
run at build time (goldmark + chroma), and the server only writes files.

Implements docs/phase-2-static-site.md:

  2.1 service skeleton   cmd/build (content -> dist), cmd/server (dist -> HTTP),
                         env-configured, 127.0.0.1:8096, /healthz with separate
                         static / ai / search readiness, --health-check probe,
                         deploy/compose.yml + deploy/Dockerfile at 120m
  2.2 rendering          templ components (Layout, Nav, PillarCard, Stage,
                         EvidenceTable, CodeBlock, Timeline, Footer);
                         `make generate` is a build step and is byte-stable
  2.3 navigation         six-area rail, <details> disclosure under 900px,
                         breadcrumbs, aria-current, L1/L2/L3 with artefact pages
  2.4 stage panel        internal/stage owns the contract; RouteDriver (fragment
                         swap) and SSEDriver (event stream) differ only in the
                         Binding, never in layout. fragment ids live in the
                         contract so route files, links and streamed frames agree
  2.5 search             SQLite FTS5 over titles and body, rebuilt by the build;
                         one handler returns a page without HTMX, a fragment with
                         it. Visitors' FTS operators are never honoured
  2.6 quality floor      print stylesheet, JS-off navigation, focus states,
                         semantic landmarks, dark default; security headers

Definition of Done evidence (see issue AUD-142):
  A1  all pages 200 in a network namespace with no external route
  one binary serves the site; make dist writes 45 pages, 86 fragments, 40 docs
  templ generate is deterministic (md5 identical across runs)
  6 L1 + 6 L2 pages, artefact pages reachable in <= 3 clicks
  FTS5 returns sensible hits for zigbee / signage / routing (tested)
  Lighthouse 100 performance and 100 accessibility, mobile and desktop
  first byte well inside 100ms over loopback (test)
  panel renders from a route driver and re-points at the stream untouched
  print legible: /edge/ renders to a 3-page PDF with the print stylesheet

Also fixes found while finishing the build:
  - reject "." / ".." path segments before ServeMux redirects them into a file
    outside the asset directory (/static/../build.json now 404, was 307->200)
  - make test is the real gate: go test ./... plus the validator self-test

Makefile

@@ -1,19 +1,61 @@
 # Ai Resume - build entry points.
 #
-# `make validate` is the single gate: it is what CI and deploy.sh call.
+# `make validate` is the content gate: it is what CI and deploy.sh call.
 # It exits 0 only on a clean content tree.
+#
+# `make build` is the site gate: it generates the templ components, compiles the
+# two small binaries and writes the pre-rendered site into dist/. One binary
+# (bin/resume-server) serves the whole site; there is no bundler and no Node.
 
 PYTHON ?= python3
 VALIDATOR := $(PYTHON) tools/validate_content.py
+GO ?= go
+TEMPL ?= templ
 
-.PHONY: validate test help
+BIN := bin
+DIST := dist
+
+.PHONY: build dist generate dev test validate validate-self-test fmt vet clean help
 
 help:
-	@echo "make validate   validate content/** front-matter against the frozen schema"
-	@echo "make test       run the validator self-test (fixtures under test/fixtures/)"
+	@echo "make build            templ generate, compile bin/, no dist"
+	@echo "make dist             build, then pre-render content into dist/"
+	@echo "make dev              pre-render into dist/ and serve it on 127.0.0.1:8096"
+	@echo "make generate         run templ generate (generated files are not committed)"
+	@echo "make test             go test ./... plus the validator self-test"
+	@echo "make validate         validate content/** front-matter against the frozen schema"
+	@echo "make fmt vet          gofmt / go vet over cmd and internal"
+	@echo "make clean            remove bin/ and dist/"
+
+build: generate
+	@mkdir -p $(BIN)
+	$(GO) build -trimpath -buildvcs=false -o $(BIN)/resume-build ./cmd/build
+	$(GO) build -trimpath -buildvcs=false -o $(BIN)/resume-server ./cmd/server
+
+dist: build
+	@$(BIN)/resume-build --dist $(DIST)
+
+dev: dist
+	@RESUME_DIST=$(DIST) $(BIN)/resume-server
+
+generate:
+	@command -v $(TEMPL) >/dev/null || { echo "templ is not on PATH; run this inside 'nix develop'"; exit 1; }
+	@$(TEMPL) generate
+
+test: generate validate-self-test
+	@$(GO) test ./...
 
 validate:
 	@$(VALIDATOR)
 
-test:
+validate-self-test:
 	@$(VALIDATOR) --self-test
+
+fmt:
+	@gofmt -l -w cmd internal
+
+vet:
+	@$(GO) vet ./...
+
+clean:
+	@rm -rf $(BIN) $(DIST)