fix(publisher): surface runtime script diagnostics - #352

What changed

• compile every enabled in-memory draft script with the same publisher compiler after edits
• show authoritative file, line, and column diagnostics in CodeMirror and the Problems pane
• block immediate and scheduled publishing while validation is pending or errors remain
• return an actionable HTTP 422 error if the server-side publish safety gate catches invalid code
• aggregate Classic and Module failures in one validation pass
• preserve invalid drafts through normal collaboration autosave so users can fix them without losing work

Why

Runtime script syntax errors were previously discovered only inside the final publish pipeline. The generic publish handler collapsed that compiler failure into an opaque 500 response, leaving users with no authored file or source location and no way to diagnose the blocker from the editor.

Impact

Authors now get IDE-style diagnostics before publishing, can reload and continue fixing the autosaved invalid draft, and cannot start a publish that the live compiler already knows will fail. The server still performs the same validation as a final safety net.

Verification

• bun run lint
• bunx tsc -b
• bun test --timeout 30000 src/__tests__/server/siteRuntimeBuild.test.ts src/__tests__/server/publishRuntimeErrorResponse.test.ts src/__tests__/server/cmsPublish.test.ts src/__tests__/persistence/cmsRuntimeClient.test.ts src/__tests__/code-editor/codeMirrorEditor.test.tsx — 27 passed
• bun test src/__tests__/toolbar/toolbar.test.ts — 54 passed
• bun run build
• React Doctor changed-files scan completed successfully; advisory findings were reviewed
• disposable real-browser E2E at 1440×1000 and 768×1024:
  • Module and Classic syntax markers and Problems rows
  • mixed-format aggregation showing two simultaneous errors
  • publish disabled while invalid
  • invalid draft restored after reload
  • error recovery without reload
  • step-up negative and positive paths
  • successful publish
  • anonymous public-page execution of both script formats

Generated E2E screenshots and the run log remain local under the repository's intentionally ignored docs/e2e/runs/ artifact path.