chore(deps): upgrade to Hugo v0.161.0 (css.TailwindCSS Node.js sandbox)

Hugo v0.161 dropped the standalone tailwindcss binary; @tailwindcss/cli
npm package is now the only accepted transformer, invoked via
`node --permission` (Node >= 22 required).

- Bump module.hugoVersion.min to 0.161.0 in modules/blox/hugo.yaml;
  add comment explaining why security.node.permissions is left to
  Hugo's built-in defaults
- Bump hugo_version / HUGO_VERSION / devcontainer image tag to 0.161.0
  across all 9 templates (hugoblox.yaml, netlify.toml, devcontainer.json)
- Bump devcontainer base image Node 20 → 22 and default Hugo version
- Add scripts/check-template-deps.mjs to assert every template declares
  tailwindcss + @tailwindcss/cli; wire as pnpm check:template-deps
- Harden CI: new audit-template-deps job gates all build jobs; add
  `require.resolve('@tailwindcss/cli/package.json')` check after each
  pnpm install to catch the exact "binary is not a Node.js script" failure

modules/blox/hugo.yaml

@@ -72,6 +72,11 @@ security:
       - ^HUGO_
       # Allow continuous integration vars
       - ^CI$
+  # Note: security.node.permissions is intentionally NOT set here. Hugo's
+  # built-in defaults already permit `tailwindcss` for allowAddons,
+  # allowChildProcess, and allowWorker (see https://gohugo.io/configuration/security/).
+  # Restating the defaults would create maintenance debt if upstream evolves them
+  # (e.g. when @tailwindcss/oxide native bindings need new permissions).
 outputFormats:
   backlinks:
     mediaType: application/json
@@ -103,7 +108,10 @@ params:
     address_format: en-us
 module:
   hugoVersion:
-    min: "0.160.0"
+    # 0.161.0 introduced css.TailwindCSS Node.js permission sandbox
+    # (Node >= 22 required) and dropped support for the standalone
+    # tailwindcss binary. The npm @tailwindcss/cli package is required.
+    min: "0.161.0"
     extended: true
   imports:
     - path: github.com/HugoBlox/kit/modules/analytics