docs site: content-hash the site's own stylesheets (cache-proof URLs)

brand.css and typography.css are referenced at fixed URLs via extra_css, so a
warm browser cache could keep serving the previous stylesheet after a deploy.
Add on_post_build to publishing/hooks.py: at build time copy each extra_css
file to <name>.<sha256-8>.css in the output and rewrite the <link> in the built
HTML. Any content change now yields a new URL. Sources keep their names; hashed
copies exist only in the build output and stale ones are pruned on rebuild.

publishing/README.md

@@ -16,6 +16,7 @@ repository root.
 | `fonts/` | Figtree woff2 files and the OFL licence text |
 | `logo.svg` | Co-op logo (shared with the website repo) |
 | `build.sh` | Stage the Markdown into `.site-src/`, render to `.site-build/` |
+| `hooks.py` | MkDocs hooks: directory-link rewriting + content-hashed stylesheet URLs |
 | `deploy.sh` | Push the build into the Surfer app container |
 | `poll-watcher.sh` | Polls Gitea main every 60s; deploys on change (agent host) |
 | `docs-deploy-poll.service` | systemd unit for the poller |
@@ -26,6 +27,19 @@ repository root.
 Nothing external is loaded by the site: no CDN, no third-party font service.
 Fonts are served from this repository's own output.
 
+### Cache-proof stylesheets
+
+`brand.css` and `typography.css` are listed under `extra_css`, so at a fixed URL
+they would be vulnerable to a stale browser cache after a deploy — a warm cache
+keeps serving the old file because the URL never changes. `hooks.py`'s
+`on_post_build` fixes this at build time: it copies each stylesheet to
+`<name>.<sha256-8>.css` in the output and rewrites the `<link>` in every built
+page to the hashed name. A change to a stylesheet's content therefore always
+produces a new URL. The authored sources keep their names and locations; the
+hashed copies exist only in the build output. The hashed copy sits in the same
+directory as the original, so the `@font-face` `url("fonts/…")` references keep
+resolving. The deploy is unchanged.
+
 ## Build
 
 ```sh