Fix cold deploy from R2 without rebaking assets

[apresmoi]

Fixes the cold deployment path without rebaking prepared packages or bulk-restoring the R2 corpus.

What changed

• regenerate the ignored source and facility catalogues during build:deploy
• read the 12 volume packages from their authoritative installed metadata while compiling the three source-only catalogue contexts in memory
• restore only prepared/presentation.json and prepared/provenance.json for catalogue compilation; large dataset textures remain on R2
• run the exact pnpm build:deploy path on relevant pull requests
• make the production browser check proxy only requested missing assets from R2 and verify their byte length and SHA-256

Why

The previous deploy path mixed source authoring, installed package metadata, and local-file assumptions. That caused successive cold-checkout failures for ignored catalogues, source-only contexts, and M31/M33 metadata. Restoring every inventoried asset would hide those boundaries and can download the full corpus, so this keeps the deploy input narrow and content-addressed.

This PR now consolidates and supersedes the incremental work from #427, #428, and #429 while retaining the original #426 history.

Validation

• 28 focused setup, availability, deploy-workflow, and catalogue tests pass
• tools and config TypeScript checks pass
• consolidated cold pnpm build:deploy passes on commit 44c827f53a
• production browser passes with content-addressed R2 requests, byte/hash verification, and zero same-origin scene requests
• remaining general repository checks are still running

No assets are generated or published by this PR.