chore(deps): upgrade to Hugo v0.161.0 (css.TailwindCSS Node.js sandbox)

Hugo v0.161 dropped the standalone tailwindcss binary; @tailwindcss/cli
npm package is now the only accepted transformer, invoked via
`node --permission` (Node >= 22 required).

- Bump module.hugoVersion.min to 0.161.0 in modules/blox/hugo.yaml;
  add comment explaining why security.node.permissions is left to
  Hugo's built-in defaults
- Bump hugo_version / HUGO_VERSION / devcontainer image tag to 0.161.0
  across all 9 templates (hugoblox.yaml, netlify.toml, devcontainer.json)
- Bump devcontainer base image Node 20 → 22 and default Hugo version
- Add scripts/check-template-deps.mjs to assert every template declares
  tailwindcss + @tailwindcss/cli; wire as pnpm check:template-deps
- Harden CI: new audit-template-deps job gates all build jobs; add
  `require.resolve('@tailwindcss/cli/package.json')` check after each
  pnpm install to catch the exact "binary is not a Node.js script" failure

package.json

@@ -41,7 +41,8 @@
     "vendor:libs": "vite build --config vite.config.js",
     "vendor:libs:watch": "vite build --config vite.config.js --watch",
     "vendor:update-and-build": "pnpm up katex mermaid markmap-autoloader alpinejs plotly.js preact --latest && pnpm vendor:libs",
-    "test:releaser": "poetry run python scripts/test_release_modules.py"
+    "test:releaser": "poetry run python scripts/test_release_modules.py",
+    "check:template-deps": "node scripts/check-template-deps.mjs"
   },
   "browserslist": "> 1%"
 }