Modernize script deployment CLI

[adriaandotcom]

Summary

Closes #94

Replaces the all-or-nothing Bash deploy.sh with a standalone TypeScript CLI (deploy.mts, powered by Clack) that drives deployment of the customer-facing tracking scripts to the Bunny CDN and the app@external.simpleanalytics.com custom-domain server.

Key behavior:

• Dry-run-first, interactive selection of scripts, destinations, and default-embed variants, with an exact per-file preview and first-line script-header diff before any write.
• Immutable SRI safeguards: versioned files are never overwritten; a published SRI version that differs blocks the deployment, and immutable targets are re-checked against authoritative storage/SSH just before upload.
• Uploaded files are read back and verified, and the Bunny pull zone is purged only when CDN files actually changed.
• Repository must be clean for a real deployment, and a second confirmation is required. The command never builds or mutates local dist files.

Also migrates the repo to pinned Node 24 / pnpm 11 with a strict supply-chain policy (pnpm-workspace.yaml: seven-day minimum release age, trust checks, exotic-subdep blocking, deny-by-default dependency builds), drops package-lock.json in favor of pnpm-lock.yaml, updates the BrowserStack workflow to pnpm, and adds test/deploy.test.mts covering the manifest, SRI transform, and preview helpers.

Changes:

• Modernize script deployment CLI
• Fix BrowserStack pnpm setup
• Update BrowserStack tests for Node 24

Security implications

Has security impact - described as: changes the deployment path for production, customer-facing tracking scripts (CDN + custom domain), handles Bunny CDN credentials and SSH-based reads/writes to the external server, and introduces a supply-chain policy for dependency installation. Remote paths are validated and shell-quoted before use over SSH, and immutable SRI artifacts are protected against overwrite.

Testing

Not run by Claude. (Automated validation could not be executed in the review sandbox.)

Author-reported validation:

• pnpm install --frozen-lockfile — supply-chain policy passed
• pnpm run typecheck
• pnpm run test:deploy — 12 tests passed
• existing compiler verified under Node 24 in an isolated copy
• live read-only dry runs verified against CDN and custom-domain targets; current v11 correctly reported immutable SRI conflicts
• pnpm audit --prod — no known vulnerabilities

The intentionally retained legacy test/build dependency graph still has pre-existing audit findings; upgrading that stack is outside this PR.

Checklist

• Linked to an issue
• Tested
• Asked for a review

[github-actions]

Claude review checkpoint

Reviewed commit 1a1e10e15a27a6ee20cfc48442b2d6a4b3a097b3. This is used to keep later automated reviews focused on changes Claude has not checked yet.