Publish opted-in marimo notebooks at /notebooks

Notebooks from the marimo server can now appear in the garden. A notebook
opts in with an HTML comment in one of its markdown cells — invisible when
rendered, greppable in the .py source:

    <!-- garden:publish
    title: Dream of Spotification
    order: 30
    -->

Default-deny on purpose: garden.c0smere.net is public and the export bakes
each notebook's executed output into the page, not just its code.
export-notebooks.py also carries a NEVER_PUBLISH list (genome_*, coursework)
so a marker pasted into one of those refuses loudly instead of publishing.

Pipeline: export-notebooks.py runs each marked notebook in a one-shot
marimo container (same image/env/GPU as the live server, so it hits the real
databases) into notebooks-export/ + index.json; copy-notebooks.mjs stages
those to public/nb/; Astro reads index.json to build the pages and the
sidebar section.

Isolation choices worth keeping:

- Own timer and own lock, separate from the 5-min garden build — executing a
  notebook takes minutes and must never hold up a build tick.
- Cached on notebook content; both index.json and .cache.json go through
  write_if_changed, since auto-build.sh hashes mtimes under notebooks-export/
  and an unconditional rewrite would force a full rebuild every 30 minutes.
- Per-notebook timeout; a failure keeps the previous export and continues.
- Runs against a throwaway copy of the notebook dir, so notebooks that write
  scratch files don't dirty the notebooks repo.
- Notebooks are NOT injected into the garden collection — they aren't vault
  notes, and doing so would move noteCount and the sitemap.

build.format:'file' makes the listing a file (notebooks.html) beside a
directory of detail pages. Verified against the running nginx: /notebooks and
/notebooks/<slug> resolve through the generic try_files but /notebooks/ does
not, so nginx.conf gets an explicit location for the trailing-slash form.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/lib/notebooks.mjs

@@ -0,0 +1,30 @@
+// Published marimo notebooks, as recorded by deploy/export-notebooks.py.
+//
+// The export script is the only thing that reads the publish markers in the
+// notebooks themselves; it hands the build this index.json. That keeps the
+// Astro build free of any dependency on the notebook directory — it isn't
+// even mounted into the build container — and means a malformed marker can
+// only ever break an export, never the garden.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const INDEX = path.join(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '..',
+  '..',
+  'notebooks-export',
+  'index.json',
+);
+
+export function loadNotebooks() {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(INDEX, 'utf8'));
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return []; // never exported: the section just doesn't render
+  }
+}
+
+export const notebookUrl = (slug) => `/notebooks/${slug}`;
+export const notebookRawUrl = (slug) => `/nb/${slug}.html`;