[tracking] infra / repo low-severity hygiene

[tkowalczyk]

Grouped low-severity infra findings.

1. data-ops build never cleans dist/ — packages/data-ops/package.json:32, tsconfig.json. Deleted modules (dist/queries/address.js, dist/zod-schema/stats.js, …) stay importable; compiled *.test.js ship in the package. Fix: rm -rf dist + exclude src/**/*.test.ts; CI diff dist vs src module sets.
2. CORS env identity delivered as secrets, not vars — hono/middleware/cors.ts:6-9; no vars block in apps/data-service/wrangler.jsonc. A missed sync-secrets makes CLOUDFLARE_ENV undefined → CORS denies all browser origins, no deploy-time error. Fix: move the three non-secret values into per-env vars.
3. sync-secrets.sh reports success on failure & mangles values — both apps. No set -euo pipefail; xargs strips quotes / errors on a single quote then pushes an empty secret, destroying the value; user-app variant co-mingles client VITE_* vars with server secrets.
4. CI Node floats lts/* vs .nvmrc 22.12.0 — .github/workflows/ci.yml:35; no engines.node. Fix: node-version-file: .nvmrc.
5. robots.txt allows full indexing on stage — apps/user-application/public/robots.txt; same public/ ships to stage + prod. Fix: Disallow: / / noindex when CLOUDFLARE_ENV !== "prod".
6. manifest.json is the unmodified scaffold — public/manifest.json ("Create TanStack App Sample", icons logo192.png/logo512.png that do not exist).
7. Stale tracked apps/user-application/pnpm-lock.yaml — dead scaffold leftover; workspace resolves from the root lockfile. Delete from git.
8. Stale worker-configuration.d.ts (both apps) — missing INTERNAL_WORKER_AUTH_SECRET / VITE_TURNSTILE_SITE_KEY, forcing unsafe casts. Fix: re-run cf-typegen; CI git diff --exit-code guard.