site generator: commands/*.md with front matter -> k8s/site/

- build/build.mjs: one-file-per-command content (filename = command,
  underscores = spaces; help/suggestion/params/prefix/text/hidden in
  front matter; ${args} ${date} ${time} ${ls} ${help} resolved at runtime)
- generates index.html (banner + chips), commands.json (the single data
  source), hello.txt for curl, style.css via tailwind v4
- src/site.js is now dispatch-only over commands.json; typewriter kept
- src/telnet.py: stdlib telnet shell sharing commands.json
- k8s: python telnet sidecar in the pod + LoadBalancer service 23->2323
- .gitea/workflows/site.yml fails CI when k8s/site/ is not the built output

.gitea/workflows/site.yml

@@ -0,0 +1,30 @@
+name: site
+
+# The cluster serves what is committed in k8s/site/ — so CI just enforces that
+# k8s/site/ is exactly what the generator produces from commands/ + src/.
+# If this job fails, run `npm run build` and commit the result.
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+
+jobs:
+  generated-is-current:
+    runs-on: ubuntu-latest
+    container:
+      image: node:22-alpine
+    steps:
+      - uses: actions/checkout@v4
+
+      - run: npm ci --no-audit --no-fund
+      - run: npm run build
+
+      - name: generated output is committed
+        run: |
+          git add -A k8s/site
+          if ! git diff --staged --quiet; then
+            echo "k8s/site/ is not in sync with commands/ + src/ — run 'npm run build' and commit:"
+            git diff --staged --stat
+            exit 1
+          fi