feat(canvas): add authoritative cloud compilation

[k11kirky]

Problem

Published canvas builds currently freeze source snapshots instead of compiling the artifact that production will execute. This prevents local preview and production from sharing an authoritative build contract.

Changes

• Run a bounded Node and esbuild compiler for queued cloud builds.
• Validate emitted paths, sizes, hashes, and manifest coverage before upload.
• Package the builder into backend CI and production images.

How did you test this code?

• Focused canvas cloud builder tests cover compilation, dependency rejection, integrity validation, and process bounds.
• Ruff check on changed Python files.
• Database lifecycle tests could not start because the local Postgres service is unavailable.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

Docs update

No user-facing documentation in this phase.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Codex implemented this continuation phase from the existing stacked design. No repository skill was invoked. The stack contracts and persistence model remain canonical; only the missing authoritative compiler behavior was ported.

---

Created with PostHog Code

[github-actions]

Hey @k11kirky! 👋

It looks like your git author email on this PR isn't your @posthog.com address (k11kirky@gmail.com). Since you're on the PostHog team, it's worth pointing your local git author email at your @posthog.com address. Why it matters:

• Consistent work identity in git history — internal tooling that attributes commits to team members keys off your @posthog.com address.
• Keeps team contributions easy to tell apart from external community ones when scanning history.

You can fix it for this repo with:

git config user.email "you@posthog.com"

Or set it globally with git config --global user.email "you@posthog.com". No need to redo this PR — just a nudge for next time. 🙂

[github-actions]

🤖 CI report

✅ Hobby preview — passed

Hobby deployment smoke test passed successfully.

---

_{Run 30256858415}

[k11kirky]

Superseded by #73874, which consolidates the full Canvas build pipeline into one reviewable PR.