harden(deploy): apply safe fixes from review report-only items

- #3 Liveness probe targets full SSR DB-querying / route, coupling pod liveness to SQLite
- #4 Chart values-staging/production.yaml are dead config under Flux; drift trap
- #6 tsconfig includes gitignored emdash-env.d.ts that only the dev server generates
- #7 Dockerfile package-lock glob + npm install fallback can silently build an unlocked image
- #8 Dockerfile creates runtime user without pinning its GID
- #9 entrypoint.sh gates `emdash init` on data.db absence, skipping migrations on PVC reuse
- #10 pullPolicy: Always vs digest pinning
- #11 Dockerfile state symlinks contradict the STATE_DIR contract; Dockerfile does not set ENV STATE_DIR
- #12 astro is a production dependency, so npm prune --omit=dev keeps build-only tooling
- #14 Two ImageUpdateAutomations write back to the same anton-helm-workloads main branch
- #16 memoryCache provider is per-process; correctness depends implicitly on replicas:1
- #17 Root catch-all [slug].astro couples nav links to pages-collection rows + DB hit per unmatched path
- #18 Detail pages render a 200-style body under a 404 status and have no try/catch around getEmDash* calls
- #19 vite allowedHosts hardcodes ddev hostnames (dev-only; no prod impact)

app/astro.config.mjs

@@ -16,8 +16,9 @@ export default defineConfig({
 	server: { host: true, port: 4321 },
 	vite: {
 		server: {
-			// Dev runs behind DDEV's nginx (https://cms-plugins.ddev.site/).
-			// Vite's host check must allow the public hostname.
+			// Dev-only: `vite.server` applies to `astro dev` / `emdash dev`
+			// (DDEV's nginx fronts https://cms-plugins.ddev.site/). Production
+			// runs the @astrojs/node standalone server, so this has no prod effect.
 			allowedHosts: ["cms-plugins.ddev.site", ".ddev.site"],
 		},
 	},

app/src/pages/[slug].astro

@@ -3,8 +3,23 @@ import { getEmDashEntry, decodeSlug } from "emdash";
 import { PortableText } from "emdash/ui";
 import Base from "../layouts/Base.astro";
 
+// Root-level catch-all for the `pages` content collection (standard Emdash model:
+// a CMS "page" IS a pages-collection row whose `entry.id` is its slug). The site nav
+// (`/about` in Base.astro) deliberately links to pages-collection rows rather than to
+// hard-coded .astro files, so adding/renaming a static page is a content edit, not a
+// code change. Consequence: every unmatched top-level path (incl. bot probes) does one
+// indexed SQLite point-lookup here and 404s on a miss. Acceptable by design — single
+// replica, single-writer local-path SQLite on kotkan, and hits already emit the
+// `cacheHint` below. Do NOT "fix" by reintroducing per-page .astro files.
+
 export const prerender = false;
 
+// Missing slug/entry → 404 status + a "Not found" body (the markup below).
+// getEmDashEntry is intentionally NOT wrapped in try/catch: a thrown error
+// here means SQLite/infra is unhealthy and should surface as a 500 (a real
+// pod-health signal on this single-replica/local-path deploy), not be masked
+// as a 404. Mirrors the emdash-kotkanagrilli reference, which also lets these
+// calls propagate.
 const slug = decodeSlug(Astro.params.slug);
 const { entry, cacheHint } = slug
 	? await getEmDashEntry("pages", slug)

app/src/pages/cms/[slug].astro

@@ -6,6 +6,12 @@ import { PLUGIN_FETCH_CAP } from "../../lib/statuses";
 
 export const prerender = false;
 
+// Missing slug/entry → 404 status + a "Not found" body (the markup below).
+// getEmDashEntry/getEmDashCollection are intentionally NOT wrapped in
+// try/catch: a thrown error here means SQLite/infra is unhealthy and should
+// surface as a 500 (a real pod-health signal on this single-replica/local-path
+// deploy), not be masked as a 404. Mirrors the emdash-kotkanagrilli reference,
+// which also lets these calls propagate.
 const slug = decodeSlug(Astro.params.slug);
 const { entry: cms, cacheHint } = slug
 	? await getEmDashEntry("cmses", slug)

app/src/pages/plugins/[slug].astro

@@ -6,6 +6,12 @@ import StatusBadge from "../../components/StatusBadge.astro";
 
 export const prerender = false;
 
+// Missing slug/entry → 404 status + a "Not found" body (the markup below).
+// getEmDashEntry/getEmDashCollection are intentionally NOT wrapped in
+// try/catch: a thrown error here means SQLite/infra is unhealthy and should
+// surface as a 500 (a real pod-health signal on this single-replica/local-path
+// deploy), not be masked as a 404. Mirrors the emdash-kotkanagrilli reference,
+// which also lets these calls propagate.
 const slug = decodeSlug(Astro.params.slug);
 const { entry, cacheHint } = slug
 	? await getEmDashEntry("plugins", slug)