fix(repo): Harden catalog sync and release integrity

Tighten the repo-state automation so canonical bot commits remain
predictable while leaving main clean after each sync.

Make the public catalog UI more honest by hiding dev-only sync,
turning stars into explicit browser-local saves, aligning risk types,
and removing hardcoded catalog counts.

Add shared public asset URL helpers, risk suggestion plumbing,
safer unpack/sync guards, and CI coverage gates so release and
maintainer workflows catch drift earlier.

tools/scripts/tests/web_app_readme.test.js

@@ -0,0 +1,26 @@
+const assert = require("assert");
+const fs = require("fs");
+const path = require("path");
+
+const repoRoot = path.resolve(__dirname, "..", "..", "..");
+const readme = fs.readFileSync(path.join(repoRoot, "apps", "web-app", "README.md"), "utf8");
+
+assert.doesNotMatch(
+  readme,
+  /^# React \+ Vite$/m,
+  "web app README should be project-specific, not the default Vite template",
+);
+
+for (const section of [
+  "## What This App Does",
+  "## Development",
+  "## Environment Variables",
+  "## Deploy Model",
+  "## Testing",
+]) {
+  assert.match(
+    readme,
+    new RegExp(`^${section.replace(/[.*+?^${}()|[\]\\\\]/g, "\\$&")}$`, "m"),
+    `web app README should document ${section}`,
+  );
+}