feat(template): fingerprint local asset URLs

[hakula139]

Summary

• Resolve the site-overridden theme stylesheet and theme-owned local scripts through kiln's static asset manifest.
• Raise the minimum kiln version to 0.3.0-rc.2 and document content-hashed local entry assets.
• Keep generated Pagefind and page-specific assets on their existing paths because kiln creates them after the manifest is built.

Design decisions

• The template keeps config.base_url separate from asset_url, so subpath deployments retain their public prefix while manifest lookup remains root-relative.
• Manifest lookup runs against the merged site and theme static tree. A site override such as /css/style.css therefore receives the hash of the file that kiln actually publishes.
• Kiln preserves the original static paths for compatibility while templates prefer the fingerprinted copies.

Related PRs

• kiln asset fingerprinting
• hakula.xyz-kiln consuming-site integration

Validation

• nix develop -c pnpm build
• nix develop -c pnpm format
• nix develop -c pnpm lint
• nix develop -c pnpm spellcheck
• nix flake check
• Built hakula.xyz-kiln with the exact kiln and IgnIt feature commits
• Verified emitted CSS and JavaScript fingerprints against the final file bytes
• GitHub Actions