Make targets now resolve a repo-local, gitignored .tools/bin (Hugo extended
0.167.0, Node 22.11.0, lychee 0.24.2) via a recipe-scoped PATH, so machines
with old/missing tools can no longer produce error-127 mysteries or version
drift. System PATH is never touched.
make bootstrap one-time idempotent install (sha256-verified Hugo)
make tool-versions pinned vs PATH-first diagnostic table
make preflight strict check, wired ahead of build/serve/serve-lan
