fix(faq): repair dead anchor links and gate them in CI

[sanity]

Problem

A user reported that https://freenet.org/about/faq/#what-is-the-status-of-freenet goes nowhere.
It has been dead since March 2025, when 6b9cf20 deleted the "What is the status of Freenet?"
section but left its entry in the FAQ's hand-maintained table of contents.

It was not the only one. Auditing every internal link in the built site turned up 33 broken
links. Counts are occurrences, so /build/ is 12 across 11 distinct hrefs (introduction
appears twice):

Page	Broken	Cause
/about/faq/	2	#what-is-the-status-of-freenet (section deleted Mar 2025); #what-is-freenet (heading deleted Jun 2024 by 947e208, in the same edit that introduced the hand-written TOC)
/about/	16	the section template renders each child's .Summary; the FAQ's summary was that TOC list, so every entry landed on /about/ as a dead fragment
/about/news/456-mitigating-sybil-attacks-in-freenet/	3	links to #identity-creation-cost / #location-hopping, but the headings are numbered (#1-…, #2-…); #peer-pressure names a section that was never written
/build/	12	the manual index's summary leaks page-relative hrefs (introduction, components/overview, #developer-guide) that resolve against /build/ instead of /build/manual/

Two root causes:

1. The FAQ's TOC was maintained by hand. The {{< toc >}} shortcode meant to generate it has
been broken since its first commit — it runs findRE "(?m)^# (.+)$" over already-plainifyd HTML,
which never matches, so it emitted an empty <ul> on every render. With no working generator, the
list drifted from the headings.

2. Section-index cards render a child's auto-summary verbatim, carrying that child's
page-relative hrefs, which then resolve against the parent's URL. That accounts for 28 of the 33.

Approach

• {{< toc >}} now emits .Page.Fragments.ToHTML 1 3, generated from the headings actually
  present. A TOC entry can no longer outlive its section. Levels are scoped to the shortcode, so no
  site-global markup config is needed; the rendered FAQ page is byte-identical to the hand-written
  version minus the dead entry, on both Hugo 0.146.4 and 0.154.5.
• Restored # What is Freenet? {#what-is-freenet}, lost in June 2024.
• Explicit summary: on the FAQ, the manual index and the history page — the three whose
  auto-summary was leaking links or dumping their own headings onto a card.
• Sybil post: links repointed at the real heading ids. Items 3 and 4 unlinked — item 3 names a
  section that was never written (git log -p --follow has zero hits for "Peer Pressure"), and
  item 4 pointed at pivotaltracker.com, which no longer resolves.

The templates themselves are unchanged, deliberately — see below.

Testing

Hugo does not validate fragments and neither did CI, which is why a dead link survived a year on
one of the site's most-read pages. scripts/check-links.py resolves every same-site reference in
the built output — <a href> plus img/link/script/iframe/source/video/audio/area/
embed/object/track — against the pages and files that exist, follows Hugo's alias redirect
stubs, and checks each #fragment against the ids on its target page. External URLs are skipped so
the check stays offline and deterministic.

# against the pre-fix build
33 broken internal link(s) across 222 page(s).   exit 1

# against this build
No broken internal links (222 pages checked).    exit 0

It gates both publish paths — deploy.yml (GitHub Pages, and it runs on PRs) and
publish-freenet.yml (the Freenet contract), which previously could ship content GitHub Pages had
rejected, silently diverging the two mirrors. cargo-make aborts on the first failing command,
verified by injecting a broken link into the built output.

The script carries a --self-test that builds a synthetic site with 17 known-bad references and
asserts it flags exactly those. That is not decoration: of 21 sabotages of check(), 19 are caught
by --self-test alone, and the two survivors change only the reason string while still reporting
the link as broken. CI runs it before trusting a clean report, so a checker that quietly stops
checking fails rather than reporting success.

Verified in a browser at 1280px and 390px, light and dark, and against both Hugo 0.146.4 (CI's pin)
and 0.154.5.

Review

Four independent blind reviewers on the first commit (code-first, adversarial, CI/deploy,
big-picture), then three more on the changes those produced. The second round was worth it — it
caught two things I had got wrong:

• A blocking regression I introduced. Tightening the static-file check from os.path.exists to
  os.path.isfile (correct on its own — a directory with no index.html is a 404) turned a silent
  pass into a false positive for any page whose path contains a non-ASCII character, because the
  page lookup was still using the percent-encoded path. One accented contributor name in
  /about/people/ would have blocked the deploy.
• A template change that did more harm than good. I had rewritten .Summary in
  list.html/single.html to strip links, to retire the mechanism behind 28 of the 33 broken
  links. Classifying every anchor it actually removed showed 26 absolute and 9 root-relative
  hrefs — and zero page-relative or fragment ones, because the summary: front matter had already
  fixed those. Its whole measurable effect was deleting 34 working links across 6 pages
  (/about/news/ cards ending in "Also available on" above an unclickable list;
  /build/manual/components/ losing "see Client SDKs", which has no sibling card, so the sentence
  pointed at nothing). Reverted. The mechanism is instead handled by convention plus the CI gate,
  with a note in the template. Scoping such a transform to relative hrefs only would fix the
  mechanism without the collateral damage — a reasonable follow-up, not something to land untested
  here.

Two findings deliberately not acted on:

• Explicit {#identity-creation-cost} ids on the Sybil headings. Those headings have carried
  numbers since the post was written, so the un-numbered fragments were never live ids and nothing
  links to them; adding explicit ids would change the ids that are live.
• Making build a required status check on main. This repo has no rulesets and no branch
  protection, so the check is advisory: once a broken link reaches main, the deploy freezes on
  every subsequent push until someone notices. Making it required would turn that into "the PR
  can't merge", which is the better failure mode — but that is a repo-governance change beyond a
  link-repair PR.

Two pre-existing bugs found along the way

• /community/get-involved/ was nondeterministic. community/get-involved.md and
  community/get-involved/index.md both claimed that URL, and Hugo picked a winner per build — 4
  of 20 identical builds served a different page, so freenet.org has been flipping between two
  versions on every deploy. hugo --printPathWarnings reports it; the plain build CI runs does
  not. Fixed here (12/12 builds identical after), because it also meant the gated build could
  differ from the published one.
• The Freenet-published mirror ships ~292 broken references, 264 of them a <script src> 404
  on every page, because build-freenet deletes files that the templates still reference. Filed as
  Freenet-published mirror ships ~292 broken references (264 of them a script 404 on every page) #104 rather than widened into this PR.

Also worth a maintainer's judgement, outside this PR: the FAQ no longer answers "what is the status
of Freenet?" at all, and the nav has no Status or Roadmap entry. Anyone arriving on the reported URL
is by definition asking that question. Restoring a dated answer would repeat the 2025 mistake, but
an evergreen entry pointing at /about/news/ would serve them.

[AI-assisted - Claude]