Tighten scope, reproducibility guarantees, and version pinning in CI/CD

Add explicit non-goals, define “CI vs production deploy,” and pin tool versions to safeguard reproducibility (pnpm version via corepack, Node version, Netlify image). Also, prefer pinning sanitize-html to an exact version (not a caret) in CI to avoid surprise upgrades.

