fix(publish): expose the public path to publish.html filters

[Mariomarquezt]

Summary

Closes #225.

publish.html filters get { pluginId, siteId, pageId, slug }. For an entry route (a blog post rendered through its entry template), pageId and slug are the template's, so a plugin cannot tell which post it is rendering.

This adds path to the filter context: the rendered page's public URL pathname (for example /posts/hello-world, and / for the home page). slug stays the page or template identity. A plugin can resolve the entry from path.

This builds on #297 by @EuanTop, rebased onto current main. His three commits are kept as he wrote them, with only merge conflicts resolved. One extra commit on top:

• Branch preview (added after fix(publish): expose entry public paths to publish filters #297) now passes the visitor's pathname too.
• Admin entry preview reports the encoded pathname (/posts/caf%C3%A9), the same value live, baked and branch-preview renders report.
• The entry SEO tests added on main after fix(publish): expose entry public paths to publish filters #297 pass the now-required url.
• republish.ts imports buildPageFrame through the @core/templates barrel.
• Docs: branch preview runs the publish.* hooks; the publish-pipeline and republishAll rows in docs/features/publisher.md match the code.

Every render path that reaches applyPublishedHtmlPipeline now sets path: live requests, full and per-row bakes, background republish, branch preview, and admin preview. 404 renders report /404.

Verification

• bun run build
• bun test — 7055 pass, 1 fail. The failure is no-circular-dependencies.test.ts hitting its 15 s timeout on my machine (madge alone reports no cycles). It fails the same way on a clean main checkout.
• bun run lint
• Docker/deployment check, if relevant (not relevant)

New tests: branch preview reports /posts/<slug>, /about and / with the template slug kept; admin preview reports the encoded path for a café slug. Both were watched failing before the fix.

Checklist

• Tests cover behavior changes.
• Docs were updated when behavior, config, deployment, or public surfaces changed.
• No compatibility shim was added for old pre-release behavior.
• No secrets, local databases, uploads, or generated artifacts are included.