feat(dev): keep dev and mock code out of release bundles

[Bugs5382]

What and why

Mock mode and the dev "Copy for UI issue" button are dev-only features, but
nothing proved their code actually drops out of a release build. This adds
scripts/check-release-bundle.mjs, run in CI against the default build, that
fails if a release bundle still carries __CRYPTOS_DEV_UI_ISSUE__,
__CRYPTOS_MOCK__ or c2pa.

The fixtures (lib/mock-fixtures.real.ts) and their empty-array stand-in
(lib/mock-fixtures.stub.ts) swap at build time through a vite.config.ts
resolve.alias keyed on VITE_FLEET_MODE (via loadEnv, so a .env file
and the shell agree) and on running under Vitest, so every build and every
test keeps reading the same @/lib/mock-fixtures specifier and seeding
lib/nodes.ts/lib/certs.ts synchronously and eagerly, exactly as before --
a release build's alias just points at the empty stand-in instead, so its
array spreads nothing and the real fixture data and the __CRYPTOS_MOCK__
marker never reach that bundle. The labels both mock and live data use
(roleLabels, identityStateLabels, summarize) stay split out into
lib/fleet/labels.ts, since they're not fixture data.

Verified on the actual built output, not just the check: a default build
contains none of the mock fixture data (checked beyond the marker, by
grepping for fixture content like node names and CNs); a VITE_FLEET_MODE=mock
or DEV_UI_ISSUE_COPY=true build correctly fails the check, naming the file.

Closes #163

Test plan

• npm run lint (eslint + prettier) clean
• npm run test -- 895/895 across all three workspaces (console 651,
  api-client 3, ui 241)
• node --test scripts/*.test.mjs -- 9 cases: dist-shape validation
  (missing/empty dist, missing index.html, missing assets/*.js), each of
  the three markers individually, the clean-pass case, and the
  entry-point guard with a space in both the script's own path and the
  dist path
• npm run build then node scripts/check-release-bundle.mjs apps/console/dist
  -- "release bundle clean"; direct grep for fixture content (not just
  the marker) confirms none of it reached the bundle
• VITE_FLEET_MODE=mock and DEV_UI_ISSUE_COPY=true builds -- the check
  correctly fails each one and names the offending chunk; CI runs both as
  a positive control before the real build's check
• The full existing test suite needed no changes beyond import-path
  updates: the mock store is still seeded synchronously at module load,
  so deep links and the default topology selection behave exactly as on
  main (e.g. node-detail.test.tsx's deep-link tests query the DOM
  synchronously right after render, no findBy/waitFor, and pass)