Keep immutable Registry archives outside the site bundle

[junlingf]

Summary

• prune immutable 1.0.0 ZIPs from the deployable static bundle after the verified build
• fetch missing archives from the pinned GitHub merge commit that first published them
• retain exact byte-size and SHA-256 enforcement before returning any archive

Validation

• full website pipeline passes locally
• fallback path tested with local static archives removed
• aurora-glass@1.0.0 retains SHA-256 a02753a3f22cd82ce67e35bb6fce5efa74e3bdd73630fe28a17fb0386910ff0b
• packaged Sites archive reduced from 63 MB to 47 MB
• identical diff previously passed PR Keep immutable Registry archives outside the site bundle #5 CI on macOS, Windows, Node 22/24, package-consumer, and website

The npm CLI remains at 0.6.3.