fix: support SSG output deployment base paths

[smiggleworth]

Summary

• add a validated outputReport.basePath public configuration option
• strip that prefix only from matching root-absolute SSG asset references
• preserve root, relative, outside-prefix, missing-asset, and staged-output behavior
• refresh the transitive Nano ID lockfile resolution so the required audit gate remains green

Review

• reviewed prefix boundary, URL decoding, traversal rejection, external/reference behavior, and staged publication ordering
• added follow-up coverage for /website-other, encoded traversal, malformed encoding, and missing prefixed assets preserving live output
• confirmed the packed public declaration exposes basePath

Validation

• npm ci
• npm audit
• npm run check (243 tests with coverage)
• npm run test:templates
• npm run test:peer-floor

Closes #84

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.