fix: gate Studio routes behind a session and repair the broken main build

Three defects found while running the release checklist against a live
backend, all on main.

1. Every TechLog route registered `access: "public"`, including the whole
   Studio surface. `decideRouteAccessForDefinition` was therefore a no-op
   for Studio: a signed-out visitor who typed /studio, /studio/documents,
   or /studio/assets got the Studio shell rendered, and the page went on
   to issue Studio API calls. Access is now derived from the spec's own
   `layoutGroup`, so a newly added Studio route is gated by construction
   rather than by remembering to restate it.

   Verified against a production-profile build: /studio* now renders the
   sign-in surface, /  and /explore are unchanged, and after signing in
   the router returns to the originally requested Studio screen.

2. `public/release-manifest.json` still declared the contract set at
   2.0.0 while the vendored contract had moved to 3.0.0 (eb86708). Boot
   verification fails closed on that mismatch, so `pnpm dev` served a
   blank screen. Regenerated from the same producer `dist/` uses.

3. `release-manifest.test.ts` asserted the same stale 2.0.0. The literal
   is deliberately independent of `EXPECTED_CONTRACT_SET_PACKAGES` (see
   the comment above it), so it is updated in place, not derived.

Also drops a dead `= null` initializer that failed `no-useless-assignment`.

check:types, lint, check:architecture, check:tech-log-contract and
check:dev-release-manifest all pass. test:all is 1818 passed with one
pre-existing load-dependent flake (provider-guardian-transaction, passes
in isolation, untouched by this change).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/features/tech-log/contracts/tech-log-route-contract.ts

@@ -139,7 +139,13 @@ export const TECH_LOG_ROUTE_REGISTRY = Object.freeze(
       spec.routeId,
       Object.freeze({
         ...spec,
-        access: "public",
+        // Studio routes are the authenticated surface. Deriving this from the
+        // spec's own `layoutGroup` -- rather than restating it per route --
+        // keeps a newly added Studio route gated by construction. Registering
+        // every TechLog route as "public" made `decideRouteAccessForDefinition`
+        // a no-op for Studio: a signed-out visitor who typed /studio got the
+        // Studio shell rendered instead of the sign-in surface.
+        access: spec.layoutGroup === "STUDIO" ? "session-required" : "public",
         loadingSurface: spec.path.endsWith("*") ? "none" : "app-shell",
         errorSurface: spec.path.endsWith("*")
           ? "not-found"