ci: guard PRs against boot-script byte drift and deploy-dep breakage

[santicomp2014]

Why

The 2026-07-01 incident (#7557 → hotfix #7560, rollback #7561) had two failure modes that were invisible to PR CI, because the production build and the deploy script's dependency chain run for the first time post-merge in the Release workflow:

1. CSP break: a build-tooling transitive (serialize-javascript v6→v7, pulled in via resolutions) changed the boot script's bytes, so the CSP script-src sha256 gating the client's inline bootstrap no longer matched → browsers blocked the client in prod (~37 min partial outage).
2. Deploy break: a fast-xml-parser: 5.7.0 pin made @aws-sdk's S3 response parsing reject the 
 entity S3 returns → every deploy blocked.

Several currently-open Dependabot PRs (#7546 rollup/terser majors, #7544 babel group) touch the same toolchain and are green for the same vacuous reason. This PR is the guard that makes them safely mergeable.

What this adds

A prod-build-guard job in PR CI that:

• builds the production bundles (yarn build) for both the PR and its base branch;
• fails if the boot script's code bytes drift (build/boot-template.js / build/boot.js). Asset cache-buster fingerprints (?abc123) are normalized away first, so routine asset changes don't trip it — only drift in the boot code (the incident class) fails. Intentional changes are acknowledged with the boot-bytes-approved label, which downgrades the failure to a warning;
• smoke-checks the deploy-time dependency chain on every PR: scripts/check-deploy-deps.js (constructs the S3 client and regression-tests the XML parser against an S3-style 
 response — the exact 2026-07-01 deploy bug) plus deploy-to-s3.js --help to exercise the deploy script's full import chain.

A determinism fix the guard surfaced: generateManifest (from @hypothesis/frontend-build) fills the manifest object in file-read-completion order, which varies run to run, and the boot bundle inlines that JSON — so two builds of identical source produced different boot bytes. The gulpfile now rewrites build/manifest.json with sorted keys before the boot bundle is built. (Proper long-term fix belongs upstream in frontend-build; follow-up worth opening there.)

Verification (local)

• Before the manifest sort: two consecutive yarn build runs produced different boot-template.js hashes (manifest key order raced). After: identical hashes across rebuilds.
• node scripts/check-deploy-deps.js passes; node scripts/deploy-to-s3.js --help exits 0.
• prettier / eslint / tsc clean on the changed files.

Notes for review

• This PR's own guard check will flag drift — expected and correct: the manifest key ordering change alters boot.js bytes once. That is strictly less churn than today (ordering is currently random every build, so releases already reshuffle it and prod tolerates it). The boot-bytes-approved label demonstrates the acknowledgement flow.
• The job only runs on pull_request (skipped when this workflow is workflow_called from Release).
• To make it merge-blocking, add Prod build & boot hash guard to the branch-protection required checks (repo admin).
• Unblocks (merge one at a time, watching the deploy): build(deps-dev): bump the rollup group across 1 directory with 4 updates #7546, build(deps-dev): bump the babel group across 1 directory with 4 updates #7544 (then close build(deps-dev): bump @babel/core from 7.28.5 to 7.29.6 #7555 as superseded), build(deps-dev): bump the sentry group across 1 directory with 2 updates #7537.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.62%. Comparing base (9d28950) to head (4f24637).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7562   +/-   ##
=======================================
  Coverage   99.62%   99.62%           
=======================================
  Files         285      285           
  Lines       11971    11971           
  Branches     2920     2920           
=======================================
  Hits        11926    11926           
  Misses         45       45           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.