fix(build): make release artifacts deterministic

[chhoumann]

Summary

• always stage Vite output under build/ so production builds cannot follow a development symlink
• install production main.js as a regular root file while retaining root symlinks for development builds
• share the Svelte preprocessor configuration and replace deprecated Rolldown output configuration
• fail builds that emit unexpected distributable chunks or would overwrite non-file artifact paths

Why

The previous production output directory was the repository root. If main.js was already the development symlink to build/main.js, a production build followed that symlink, so artifact topology depended on checkout history. Releases still consume root main.js; this change makes that artifact deterministic without changing the release or E2E contract.

Verification

• production -> development -> production artifact transition passed
• production root main.js is a regular file and root main.js.map is absent
• development restores root main.js and main.js.map symlinks
• root and staged production artifacts have matching SHA-256 hashes
• resulting production bundle is byte-identical to the baseline: 6f593e89c049bc84a8a9b3da90a5f002ccc5b8e1066ae05aef671dbc12cd5ebc
• all prior Vite/Rolldown/Svelte configuration warnings are gone
• isolated Obsidian loaded and reloaded PodNotes 2.17.3 with no runtime errors, then the private instance was stopped and removed

Validation

• npm run lint
• npm run format:check
• npm run typecheck
• npm run build
• npm run test - 70 files, 883 tests
• focused build-artifact tests - 7/7
• docs build through docs/requirements.txt
• git diff --check

Release impact

Root main.js remains the release and attestation asset. No consumer path changes are required.

[cloudflare-workers-and-pages]

Deploying podnotes with    Cloudflare Pages

Latest commit:	fa5cfc3
Status:	✅  Deploy successful!
Preview URL:	https://cd345423.podnotes.pages.dev
Branch Preview URL:	https://chore-harden-build-artifacts.podnotes.pages.dev

View logs