chore(deps): upgrade to Hugo v0.161.0 (css.TailwindCSS Node.js sandbox)

Hugo v0.161 dropped the standalone tailwindcss binary; @tailwindcss/cli
npm package is now the only accepted transformer, invoked via
`node --permission` (Node >= 22 required).

- Bump module.hugoVersion.min to 0.161.0 in modules/blox/hugo.yaml;
  add comment explaining why security.node.permissions is left to
  Hugo's built-in defaults
- Bump hugo_version / HUGO_VERSION / devcontainer image tag to 0.161.0
  across all 9 templates (hugoblox.yaml, netlify.toml, devcontainer.json)
- Bump devcontainer base image Node 20 → 22 and default Hugo version
- Add scripts/check-template-deps.mjs to assert every template declares
  tailwindcss + @tailwindcss/cli; wire as pnpm check:template-deps
- Harden CI: new audit-template-deps job gates all build jobs; add
  `require.resolve('@tailwindcss/cli/package.json')` check after each
  pnpm install to catch the exact "binary is not a Node.js script" failure

scripts/check-template-deps.mjs

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+const REQUIRED = ["tailwindcss", "@tailwindcss/cli"];
+const TEMPLATES_DIR = resolve(process.argv[2] ?? "templates");
+
+const failures = [];
+const checked = [];
+
+for (const name of readdirSync(TEMPLATES_DIR).sort()) {
+  const dir = join(TEMPLATES_DIR, name);
+  if (!statSync(dir).isDirectory()) continue;
+
+  const pkgPath = join(dir, "package.json");
+  let pkg;
+  try {
+    pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+  } catch (err) {
+    if (err.code === "ENOENT") continue;
+    failures.push(`${name}: package.json unreadable — ${err.message}`);
+    continue;
+  }
+
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  const missing = REQUIRED.filter((dep) => !(dep in deps));
+  if (missing.length) {
+    failures.push(`${name}: missing ${missing.join(", ")}`);
+  } else {
+    checked.push(name);
+  }
+}
+
+if (failures.length) {
+  console.error("✗ Template dependency audit failed:\n");
+  for (const f of failures) console.error(`  ${f}`);
+  console.error(
+    `\nHugo >= 0.161.0 requires the npm @tailwindcss/cli package — the standalone tailwindcss binary is no longer accepted.`,
+  );
+  process.exit(1);
+}
+
+console.log(`✓ All ${checked.length} templates declare required Tailwind dependencies:`);
+for (const name of checked) console.log(`  ${name}`);