chore(deps): upgrade to Hugo v0.161.0 (css.TailwindCSS Node.js sandbox)

Hugo v0.161 dropped the standalone tailwindcss binary; @tailwindcss/cli
npm package is now the only accepted transformer, invoked via
`node --permission` (Node >= 22 required).

- Bump module.hugoVersion.min to 0.161.0 in modules/blox/hugo.yaml;
  add comment explaining why security.node.permissions is left to
  Hugo's built-in defaults
- Bump hugo_version / HUGO_VERSION / devcontainer image tag to 0.161.0
  across all 9 templates (hugoblox.yaml, netlify.toml, devcontainer.json)
- Bump devcontainer base image Node 20 → 22 and default Hugo version
- Add scripts/check-template-deps.mjs to assert every template declares
  tailwindcss + @tailwindcss/cli; wire as pnpm check:template-deps
- Harden CI: new audit-template-deps job gates all build jobs; add
  `require.resolve('@tailwindcss/cli/package.json')` check after each
  pnpm install to catch the exact "binary is not a Node.js script" failure

.github/workflows/ci-build-starters-matrix.yml

@@ -43,7 +43,25 @@ env:
     NODE_VERSION: "22"
 
 jobs:
+    audit-template-deps:
+        name: Audit template Tailwind dependencies
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v6
+
+            - name: Setup Node.js
+              uses: actions/setup-node@v6
+              with:
+                  node-version: "${{ env.NODE_VERSION }}"
+
+            - name: Verify every template declares @tailwindcss/cli + tailwindcss
+              # Hugo >= 0.161.0 requires the npm @tailwindcss/cli package; the
+              # standalone tailwindcss binary is no longer accepted.
+              run: node scripts/check-template-deps.mjs
+
     build-templates:
+        needs: audit-template-deps
         runs-on: ubuntu-latest
         strategy:
             fail-fast: false
@@ -99,6 +117,13 @@ jobs:
               # and may not have lock files checked into the repo
               run: pnpm install --no-frozen-lockfile
 
+            - name: Verify @tailwindcss/cli resolves via node_modules
+              # Hugo >= 0.161.0 invokes node @tailwindcss/cli/dist/index.mjs directly.
+              # If require.resolve fails here, Hugo will fall back to PATH and emit
+              # "binary tailwindcss is not a Node.js script" at build time.
+              working-directory: ${{ matrix.starter.path }}
+              run: node -e "require.resolve('@tailwindcss/cli/package.json')"
+
             - name: Read Hugo version from template
               id: hugo
               run: |
@@ -123,6 +148,7 @@ jobs:
 
     smoke-test-latest:
         name: Test site on latest Hugo (allowed to fail)
+        needs: audit-template-deps
         runs-on: ubuntu-latest
         continue-on-error: true
         steps:
@@ -148,6 +174,10 @@ jobs:
               working-directory: test
               run: pnpm install --no-frozen-lockfile
 
+            - name: Verify @tailwindcss/cli resolves via node_modules
+              working-directory: test
+              run: node -e "require.resolve('@tailwindcss/cli/package.json')"
+
             - name: Cache Hugo resources (test)
               uses: actions/cache@v5
               with:
@@ -168,6 +198,7 @@ jobs:
 
     canary-academic-latest:
         name: academic-cv on latest Hugo (allowed to fail)
+        needs: audit-template-deps
         runs-on: ubuntu-latest
         continue-on-error: true
         steps:
@@ -190,6 +221,10 @@ jobs:
               working-directory: templates/academic-cv
               run: pnpm install --no-frozen-lockfile
 
+            - name: Verify @tailwindcss/cli resolves via node_modules
+              working-directory: templates/academic-cv
+              run: node -e "require.resolve('@tailwindcss/cli/package.json')"
+
             - name: Cache Hugo resources (template)
               uses: actions/cache@v5
               with:
@@ -210,6 +245,7 @@ jobs:
 
     smoke-test-min:
         name: Test site on minimum supported Hugo
+        needs: audit-template-deps
         runs-on: ubuntu-latest
         steps:
             - name: Checkout
@@ -234,6 +270,10 @@ jobs:
               working-directory: test
               run: pnpm install --no-frozen-lockfile
 
+            - name: Verify @tailwindcss/cli resolves via node_modules
+              working-directory: test
+              run: node -e "require.resolve('@tailwindcss/cli/package.json')"
+
             - name: Read minimum Hugo version from framework
               id: min
               run: |

.github/workflows/devcontainer-image.yml

@@ -14,8 +14,9 @@ on:
 
 env:
   IMAGE_NAME: ghcr.io/hugoblox/hugo-blox-dev
-  DEFAULT_HUGO_VERSION: 0.152.2
-  NODE_VERSION: 20
+  # Hugo >= 0.161.0 requires Node >= 22 for css.TailwindCSS Node permissions.
+  DEFAULT_HUGO_VERSION: 0.161.0
+  NODE_VERSION: 22
   PNPM_VERSION: 10.14.0
 
 jobs: