build: isolate Pixi integration environments

[leej3]

AI-generated draft — not reviewed by John

Summary

• make the root Pixi environment installable and testable before any submodule
  checkout;
• retain checkout-submodules as the idempotent, exact recursive setup for full
  cross-component engineering work;
• add locked build-upstream-static and serve-upstream-static tasks backed by
  a standalone PEP 723 Pixi script;
• verify the upstream static build from a non-recursive clone on Linux and
  macOS CI; and
• retire the legacy CON task and Pages facade from main while preserving it
  in Git history.

Why

The previous root environment declared Python packages from uninitialized
submodule paths. Pixi therefore needed those submodules before it could create
the environment containing the checkout helper—a circular bootstrap. It also
mixed engine development, the historical CON migration stack, Hugo, Node, and
git-annex into one lock and task namespace.

Submodules remain useful: their gitlinks are the reviewed source-level pins for
cross-repository integration. The change is that checkout is no longer an
accidental prerequisite for every root command. A full checkout is explicit,
while a scoped integration task may initialize only the exact gitlinks it
needs. Updating an upstream still means advancing and committing its gitlink on
a review branch, then running these checks against that recorded candidate.

The repository now requires Pixi >=0.76,<0.77; the latest published release
verified during this work was 0.76.2. The upstream script uses Pixi's locked
inline script environment for Hugo and platform-specific git-annex packaging.

Impact

The supported root facade is now engineering-focused:

• pixi run test
• pixi run checkout-submodules
• pixi run build-upstream-static
• pixi run serve-upstream-static

The unqualified Milestones 1–3 CON tasks and manual CON Pages workflow are
removed from main. They remain recoverable from preserved history. Ordinary
Orinoco Lite consumers continue to own their site-level build, serve, update,
and Pages commands.

Release-authorized workflows still initialize their own exact fixtures, so the
package/editor/runtime release boundary is unchanged. A source-dependent editor
test now skips only when its pinned fixture was intentionally not checked out;
the release workflow initializes that fixture and continues to execute it.

Verification

• pixi install --locked
• pixi lock --check
• pixi lock --script tools/upstream_static.py --check
• pixi run test — 44 engine tests and 25 development tests pass; 3 optional
  fixture tests skip in the deliberately non-recursive checkout
• pixi run build-upstream-static — builds and audits 1,973 upstream pages
• pixi run serve-upstream-static — the generated root is byte-identical and
  responds successfully through both 127.0.0.1:8768 and localhost:8768
• targeted Snapper pre-commit check
• shell/Python/YAML syntax checks
• git diff --check

The new GitHub workflow repeats the non-recursive install/test/build sequence on
Ubuntu 24.04 and macOS 14.