fix: harden static build reliability

[tiankaima]

Summary

• retain and fall back across recent Pages artifacts so incremental curriculum/Young builds survive scheduler jitter
• isolate RSS, curriculum, and Young builders; restore last-known-good outputs after a builder failure and publish a machine-readable degraded status when another builder succeeds
• bound browser/feed/workflow timeouts, use structured HTTP status handling, and make the JW retry override effective
• preserve cached RSS output on fetch/parse failures
• enforce Ruff formatting and the unittest suite in CI, formatting the five existing drifted files

Closes #18
Closes #19
Closes #20
Closes #21
Closes #22
Closes #23
Closes #24
Closes #25

Verification

• uv run ruff check .
• uv run ruff format --check .
• uv run python -m unittest discover -s tests -p 'test_*.py' (37 tests)
• actionlint .github/workflows/*.yml
• uv run python -m compileall -q main.py src tests
• uv run python main.py --rss against all four configured feeds; verified build/build-status.json reports rss: ok and all generated XML files are non-empty

Operational behavior

A failed builder restores its pre-run output before the next builder starts. A mixed-success daily run can deploy fresh successful products alongside last-known-good failed products and records the per-builder result in build/build-status.json; a run where every selected builder fails still exits non-zero. No credentials or production mutations are involved in local verification.