CI to export module catalog to 4cat-site

[dale-wahl]

Summary

Publishes the 4CAT module catalogue as a static site, generated from 4CAT itself so the public page and the in-app one cannot drift apart. Now live at https://4cat.nl/catalog/.

Three parts:

• An exporter (helper-scripts/export_module_catalogue.py) that writes a self-contained bundle — page, styles, renderer, icons and one JSON file — servable by any static web server. No 4CAT, no API and no database behind it.
• A shared renderer. The live catalogue and the published one now use one JavaScript file, one markup fragment, and 4CAT's real stylesheets (discovered by following fourcat-new.css's own imports, so the catalogue tracks the redesign without anyone updating the exporter).
• A release job that runs on release: published, exports from the image that was just pushed, and opens a PR against 4cat-site replacing public/catalog/.

The details

• manifest.json is the bundle entry point, per a contract agreed with 4cat-site and written up in docs/module-catalog-export-contract.md.
• Provenance is truthful: a release is only claimed when the commit is exactly tagged, or when CI names the tag. Anything else publishes as a development snapshot and says so on the catalog page.
• The export validates its own output and fails rather than publishing a partial or drifted bundle — should refuse if the two catalogues stop sharing their markup, or if a stylesheet starts loading from another server.
• The catalogue job is continue-on-error: a broken export does not block Docker release (it is after it anyway) and does not make a PR on 4cat-site

Side note

• The page does loads its typefaces from Google Fonts. It's the same request 4CAT's own pages make, but means it is not 100% self contained.

Also fixed along the way

• The header logo's mask-image carried a for testing override is pointing at 4cat.digitalmethods.net, so every page fetched its logo from another server (not sure who was testing that).
• Catalogue icons now follow the module-icon convention, so the brand-* icons render instead of coming out blank. (This this was a half change on redesign branch.)

Before merging

• Needs the CATALOGUE_SITE_APP_ID and CATALOGUE_SITE_APP_PRIVATE_KEY secrets (already added to 4CAT and tested).
• docker_new_release.yml will conflict when this eventually reaches master, which carries a smaller stub of the same change (to allow the manual Action runs). It can be replaced with this branch's file.