fix(build): build island manifest in build:all, not the ignore-scripts-silenced postbuild:apps hook

[jung-thomas]

Problem

Five merged fixes (#1584/#1591/#1594/#1595/#1596) appeared "not live" on DEV after a workstation deploy — but the deploy succeeded and build:all did run. The real root cause:

The #1604 island-fingerprint step build:island-manifest (writes hugo/data/island_manifest.json) was wired only into the postbuild:apps npm lifecycle hook. This repo runs ignore-scripts=true globally, so that hook never fires during a local npm run build:all. Consequences:

• island_manifest.json was never written
• hugo/layouts/partials/island-src.html fell back to the unhashed /js/<name>.js path
• Hugo baked the stale path; the approuter shipped old bundles while the freshly-compiled fingerprinted ones (navigator-COpSY_iS.js, homepage-explainers-OVitlVky.js) sat unreferenced next to them

The fixes were compiled — just never referenced. This is a different failure from the "no build:all before mbt" class (that one was already guarded). CI is immune because deploy.yml/unit-tests.yml run npm run postbuild:apps as an explicit step (deploy.yml:217-223 documents the trap). Only workstation deploys hit it.

Fix

1. package.json — build:all now calls npm run build:island-manifest explicitly (right after build:apps), so it runs regardless of ignore-scripts.
2. scripts/deploy-mta.cjs — new Step 2.5 fails the deploy fast if hugo/public/index.html bakes only unhashed island paths while a Vite manifest exists (belt-and-suspenders for the whole class).
3. CLAUDE.md — new gotcha documenting the ignore-scripts/lifecycle-hook trap and the rule: a build artifact needed for a correct ship must be an explicit build:all step, never a post*/pre* hook.

Verification

• node --check scripts/deploy-mta.cjs ✓
• Guard regex validated against the real built homepage — matches hashed refs, would die on all-unhashed ✓
• Locally: with the manifest present, build:hugo now bakes /js/homepage-explainers-OVitlVky.js + /js/navigator-COpSY_iS.js ✓