Fix hosted Blazor WASM HTML placeholder publishing

[Copilot]

Fixes dotnet/runtime#121121

Hosted Blazor WASM publishing used a separate project instance that lost the transient HTML placeholder input created during build. As a result, server publish output retained empty import maps and fingerprint placeholders.

• Persist placeholder source

  • Retain original HTML as an AssetKind=Publish static web asset in the build manifest.
  • Keep generated replacement HTML in the Build slot.

• Publish reconstruction

  • Rebuild the publish HTML input collection from persisted non-build HTML assets.
  • Generate publish-time replacement HTML and endpoints from that source.

• Compression

  • Exclude the publish-only placeholder source from build compression.

Scoping the re-tag to the placeholder source assets

The first iteration re-tagged the original HTML with Update:

<StaticWebAsset Update="@(_HtmlFilesToRemove)">
  <AssetKind>Publish</AssetKind>
  <HtmlAssetPlaceholderSource>true</HtmlAssetPlaceholderSource>
</StaticWebAsset>

Inside a target, Update="@(items)" applies the metadata to the entire StaticWebAsset item list, not just the referenced items. Every static web asset — including all 212 WasmResource assets — was flipped to AssetKind=Publish and persisted that way into the on-disk build manifest. At publish time those assets then matched dotnet/runtime's _WasmPublishAsset filter (AssetKind != Build and AssetTraitName == WasmResource) in addition to the copy produced by ProcessPublishFilesForWasm, so GenerateWasmBootJson hit a duplicate dictionary key and failed the build with System.ArgumentException: An item with the same key has already been added.

MatchOnMetadata / MatchOnMetadataOptions do not help here — they are matching controls for Remove, not a scoping mechanism for Update, and silently no-op. The fix builds a dedicated item list and does Remove + Include instead:

<_HtmlPlaceholderSourceAssets Include="@(_HtmlFilesToRemove)">
  <AssetKind>Publish</AssetKind>
  <HtmlAssetPlaceholderSource>true</HtmlAssetPlaceholderSource>
</_HtmlPlaceholderSourceAssets>
<StaticWebAsset Remove="@(_HtmlFilesToRemove)" />
<StaticWebAsset Include="@(_HtmlPlaceholderSourceAssets)" />
<StaticWebAsset Include="@(_UpdatedHtmlStaticWebAssets)" />

Regression coverage

• Enable placeholder replacement in the hosted WASM fixture.
• Validate hosted publish output has populated import maps, replaced preload placeholders, no fingerprint tokens, and script/preload/import map entries that resolve to real endpoints and files on disk.
• Add a NoBuild=true variant that builds the Server, deletes the publish output, then publishes. This covers the path where publish must rewrite the HTML from the persisted build manifest rather than from in-memory build state — the scenario the placeholder-source persistence exists for.
• Assert the compressed index.html.gz / index.html.br payloads decompress to exactly the rewritten HTML, so compressed variants cannot go stale against the placeholder-replaced document.
• Assert the Client build manifest keeps every WasmResource asset as a Build asset and that index.html is the only Publish asset. This is a direct guard against the metadata leak described above.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Thanks for your PR, @copilot.
To learn about the PR process and branching schedule of this repo, please take a look at the SDK PR Guide.