Make application builds deterministic and independently verifiable

[DenWin]

Parent: #31. Coordinate with #3, #6, #16, and #32.

Current evidence

• package.json has no test script despite an existing suite.
• CI uses bun install without --frozen-lockfile.
• Build invokes bun x @tailwindcss/cli, which can permit implicit resolution if the local dependency is unavailable.
• Generated CSS is ignored and created during build, but drift/reproducibility is not assessed.
• Build, test, lint, Docker build, and release commands are spread across workflows rather than one stable local interface.
• Base images, APT packages, pipx content, and downloaded binaries are not fully immutable yet.

Required work

• Define stable scripts for test, test:coverage, typecheck, lint, format:check, build, and validate.
• Use frozen/locked dependency installation everywhere.
• Invoke locally installed build tools explicitly; forbid undeclared downloads during compile/test.
• Separate dependency resolution from offline build execution.
• Add a clean-room build from a fresh checkout.
• Verify generated artifacts are reproducible or document/measure expected nondeterminism.
• Ensure build does not depend on developer-local state, writable source directories, or undeclared environment variables.
• Record versions and inputs in build metadata.
• Add artifact checksums and compare repeated builds where practical.
• Validate production dependency closure independently from development dependencies.
• Define cache keys that improve performance without changing build results.
• Keep local validation and CI commands aligned.

Acceptance criteria

• A single documented validation command reproduces required CI checks.
• Clean checkout plus lockfile is sufficient to build.
• Build/test succeed with network disabled after dependencies are prepared.
• Missing undeclared tools/dependencies fail clearly.
• Repeated builds are compared and unexplained drift fails.
• Production artifacts contain only declared runtime content.