fix(templates): migrate Astro starter to v6.4.8 + Tailwind 4 (clears SSRF/XSS advisories)

[PAMulligan]

Summary

Closes #107. Migrates the templates/astro starter off the vulnerable Astro 5 line to Astro 6.4.8, clearing all five open Dependabot advisories on the template (two HIGH). Every fix lands only in Astro ≥ 6.x — there is no 5.x backport — so this is necessarily a major bump.

CVE	Severity	Patched in
CVE-2026-54299 — host-header SSRF in prerendered error page	HIGH	6.4.6
CVE-2026-50146 — reflected XSS via unescaped slot name	HIGH	6.3.3
CVE-2026-54298 — XSS via unescaped attribute names in spread props	medium	6.4.6
CVE-2026-41067 — XSS in define:vars	medium	6.1.6
CVE-2026-45028 — server-island param replay	low	6.1.10

What changed

• astro ^5.18.2 → ^6.4.8 (latest 6.x; chosen over the 0-day-old 7.0.5 for a smaller, more battle-tested surface).
• @astrojs/react ^4 → ^6 (React 19 supported).
• Dropped @astrojs/tailwind — its latest release only supports Astro ≤ 5. Replaced with Tailwind 4 via @tailwindcss/vite. Styles now load from a new src/styles/global.css (imported once in index.astro) that pulls in Tailwind and bridges the existing tailwind.config.mjs through @config, so the token-lock / converter injection point is preserved.
• tailwindcss ^3 → ^4.
• Pinned vite ^7.3.2 to match Astro's own dependency. Without it, pnpm's auto-install-peers pulled Vite 8 for @tailwindcss/vite while Astro ran Vite 7, crashing the build on Vite 8's rolldown resolve binding.
• Added templates/astro/pnpm-lock.yaml so the template's dependency tree is lockable and trackable (issue task Pixel-perfect Figma alignment for Score and Setup pages #1).
• Gitignored Astro's generated .astro/ dir; refreshed the multi-framework + templates docs; bumped the astro-hybrid test fixture to 6.4.8.

Verification

• pnpm install resolves cleanly (single Vite 7.3.6, no Vite 8).
• astro build → static output generated; Tailwind 4 + @config process without error.
• vitest + Container-API harness initialises under Astro 6.
• renderer-registry test (the only CI test touching the changed fixture): 12/12 pass.
• CI lint (eslint + prettier) ignores templates/, docs/, .claude/, so no formatting risk. Stryker is unaffected — it targets packages/pipeline only and never runs on PRs.

Notes / follow-ups

• The template only used default Tailwind utilities (no custom tokens yet), so the Tailwind 3 → 4 blast radius here is minimal.
• GitHub still reports other advisories on the default branch (unrelated non-Astro packages) — those are outside [Security] Astro SSRF/XSS advisories require breaking major bump (^5 → 6.4.6) in templates/astro #107's scope.
• To make Dependabot actually open update PRs for the templates (beyond alerts), a scoped .github/dependabot.yml is the real enabler — recommended as a small follow-up.

🤖 Generated with Claude Code