feat(web): packages.wheels.dev static site (#2271)

[bpamiri]

Summary

Adds packages.wheels.dev as a fifth Astro static site alongside wheels.dev / blog.wheels.dev / guides.wheels.dev / api.wheels.dev. Fed by the wheels-dev/wheels-packages registry at build time; rebuilt on registry merges via repository_dispatch.

Closes the wheels.dev half of #2271. (The in-app /wheels/packages half shipped in #2277.)

Changes

• web/sites/packages/ — new Astro site:
  • Card-grid listing page with client-side filter + copy-to-clipboard install snippets
  • Dynamic [name].astro detail pages with version history table, homepage link (gated ^https?://), and rendered README
  • Build-time fetch from GitHub registry (no runtime — fails loud if registry is unavailable, Cloudflare keeps prior deploy)
• web/sites/packages/src/lib/registry.ts + tests (10 tests) — fetcher + listAll with manifest/directory-name drift guard
• web/sites/packages/src/lib/markdown.ts + tests (6 tests) — unified / remark / rehype-sanitize / rehype-shiki pipeline; sanitizer runs BEFORE shiki
• web/vitest.config.ts + per-site configs — first unit-test runner in the web/ workspace
• .github/workflows/web-deploy.yml — added packages to deploy matrix, added repository_dispatch: [registry-updated] trigger, gated registry-triggered runs to the packages slot only
• web/tests/visual-baselines/packages-*.png — new visual-regression baselines

Security posture

• Homepage links gated to ^https?:// on both listing + detail
• README sanitized through rehype-sanitize with defaultSchema (relaxed only for pre/code/span class+style so shiki's output survives). Empirically verified: with the sanitizer removed, javascript: URLs slip through — confirming the sanitizer is load-bearing.
• set:html in detail page receives only sanitizer output; two independent gates (allowDangerousHtml: false on remark-rehype + rehype-sanitize)
• data-search haystack on cards uses Astro attribute escaping

One-time prep status

• Cloudflare Pages project wheels-packages + packages.wheels.dev custom domain — done by @bpamiri
• Cross-repo PR in wheels-dev/wheels-packages: wheels-packages#2 — adds the notify-site.yml workflow that fires repository_dispatch on manifest merges. Needs NOTIFY_WHEELS_TOKEN PAT secret created before merging (detailed in that PR)

Test plan

• Unit tests pass: cd web/sites/packages && pnpm test → 16 pass
• Build succeeds against live registry: pnpm --filter @wheels-dev/site-packages build → 5 pages (index + 4 detail)
• Visual regression baselines captured and pnpm visual:test green
• CI full matrix green (waiting on PR CI)
• Post-merge: visit packages.wheels.dev, confirm all 4 current packages render
• Post-cross-repo-merge: touch a manifest, confirm site rebuilds within ~3 min

Notes

• Visual baselines were captured on macOS/ARM Chromium. If CI's Linux rendering diverges beyond the 200px threshold, download CI's *.actual.png from the diffs artifact and commit as the new baselines (standard recovery per the workflow comment).
• Commit messages in this branch follow feat(docs) / fix(docs) etc. scopes. The commitlint config allows docs broadly; the site-specific web/packages scope doesn't exist yet and can be added in a follow-up if desired.

Spec & plan

• Spec: docs/superpowers/specs/2026-04-23-wheels-packages-phase4-site-design.md
• Plan: docs/superpowers/plans/2026-04-23-wheels-packages-phase4-site.md

Refs #2271, #2243