feat(templates): migrate to Zola 0.23 and Tera 2

[forkwright]

Summary

• pin Typikon and both generated consumer gates to the official Zola 0.23.3 Linux artifact;
• migrate the theme from removed Tera 1 macro/filter syntax to collision-resistant typikon.* Tera 2 components;
• preserve Zola's engine-owned feed page set, including include_in_feeds, ordering, and limit behavior;
• add static contracts, a real multilingual renderer fixture, and durable bounded failure diagnostics.

This is the separately gated renderer prerequisite for #179. It intentionally does not implement or close the scoped-root-feed issue, and it changes no consumer repository.

Why this is separate

Zola 0.22.1 does not expose the include_in_feeds page field required by #179 acceptance item 4. Zola 0.23 does, but also moves rendering to Tera 2. A version-only bump would break Typikon's macro imports, namespace calls, removed collection/string filters, positional test arguments, and consumer shortcodes.

Compatibility contract

• theme.toml requires and bin/typikon-defaults.sh defaults to Zola 0.23.3. Typikon's gate pins that version directly, and both consumer gate templates receive it when rendered. Those three download surfaces pin SHA-256 f07c92607e5745268b576bd325ceef3a582aada253bb64db8d92a8a85303d958.
• Components use a typikon.* namespace because Tera 2 registers components globally.
• Components receive only declared arguments; breadcrumb callers pass both config and the current language explicitly.
• Consumer template overrides and removed Zola shortcodes must migrate before a consumer raises its pin.

Exact-head proof

GitHub Gate Attestation run 32387018419 completed successfully for head 7545041b93576b0abca62d3d6a4890abda3b14d3 and synthetic merge commit 48120c02548432a31815ad86cf5401358ecee770 / tree 65bcba0d695a0d63f127c405abf61e37bfb0be56.

The hosted gate proved:

• Zola 0.23.3 parses and renders both consumer fixtures;
• the multilingual Tera 2 fixture preserves author fallbacks, translated breadcrumbs, and ordered sameAs values;
• both sample sites pass CSP enforcement;
• hostile FAQ text remains visible while JSON-LD escapes script termination and round-trips to the exact question and answer;
• failed-stage details survive CI capture through bounded, JSON-framed replay;
• Atom outputs are well-formed and begin at the XML declaration;
• all remaining full-gate checks pass.

Kanon MCP lint reports 0 violations with 6 existing suppressions. git diff --check, the static Tera contract, Python AST checks, schema validation, and fixture discovery also pass.

No Zola build was run locally; the exact GitHub-hosted build is the renderer authority. Runs 32322479432, 32323223834, 32378738973, 32380347712, 32383486818, and 32385620561 successively exposed null updated, Jiff-incompatible formatting, XML declaration displacement, an unreplayed CSP failure log, the FAQ JSON-LD breakout, and a stale entity-spelling assertion; each now has a static or rendered regression.

Next boundary

After this prerequisite lands, #179 still needs its own scoped-root-feed implementation and consumer migrations. Those changes are outside this PR.

Refs #179