refactor(site): move the dependency-closed set of site files into their owner folders

[apresmoi]

What changed

• First S4 pull request: 189 files move into their owner folders with apply-moves.mts (75 source files and 114 tests), using the map in .github/site-refactor.json. Root files in site/: 187 to 98 in total, 118 to 59 without tests.
• The set is the dependency-closed part of the move map that no pending S3 change touches: a file moves only if everything it imports from site/ moves too or already lives in a folder, and nothing the rest of the plan edits is moved.
• Imports, new URL(...) literals, globs, tsconfig, eslint, package.json scripts, workflows, ci-areas.json, the coverage ratchet floors (each floor follows its file), docs links and code spans were rewritten by the codemod and the old-path reference gate (site-architecture.mts --references --old): 0 live old-path references remain.
• Hand edits that depth changes require: relative reads in 7 moved tests (../ to ../../), a glob in dot-catalogue-data, fixtures that build temporary checkouts now create the new folders, and the audit workflow's test glob names site/browser/source-link.test.mts.
• Plan inputs: moves.json loses the applied entries, tiers.json follows its test and asset paths, the tables are regenerated. Two small tool changes: fixtures under any site/**/fixtures/ count as test helpers for the nebula boundary check, and the move declaration counts as plan input for the reference gate.
• Not moved, and why:
  • site/object-shell.css and site/components/ObjectSwatchStyles.astro: the build writes their path into every page (data-object-style="..."), so moving them changes HTML and server answers.
  • site/startup-world.mts (and what imports it): the server-side bundle keeps its relative new URL('../src/...') literal.
  • site/diagnostic-recorder.mts, site/selection-presentation.mts, site/destination-browser.mts, site/feature-browser.mts and the two selection files: a root file keeps importing them, which would close a folder cycle the baseline does not record.
  • Files touched by the pending S3 changes (held address, moon catalogue, loader owners, their tests), the four tracked .d.mts stand-ins and the generated site/prepared-* files, which move with their producers later.
• Test identity: pnpm test:site runs 1,777 tests: 1,746 pass, 30 skipped, 0 failures; the one timeout under load (ci-speed.test.mts, new from perf(ci): per-package compiled cache, test shards, single generator pass #1345) passes alone, 6 of 6. The executed set maps one to one through the move map.

Checks

Local comparison lane against main 8fe5f3a (production ASSET_ORIGIN builds, one shared base build; CI does not run the lane):

• L3 built-site comparison, pure-move mode: 0 differences, semantic and layout equality both hold, 9,892 pages and 46,452 files.
• L2 server answers: preview 352, netlify 350 and cloudflare 347 answers identical.
• L7 counted performance guard: pass, 0 findings.
• L1 journeys: not run; the harness refuses production-origin builds.

Other checks:

• pnpm typecheck:shell, typecheck:tests, typecheck:scripts, typecheck:ownership, eslint on site, .github/scripts and the touched entry points.
• pnpm check:architecture (baseline unchanged), site-architecture.mts --accept, --sequence, --minimality, 218 architecture, ratchet and move-tool tests, check-stale-references, check-documentation-links.

Follows the pull request rules.