#97 release artifacts are served as active HTML/SVG (stored XSS)

What

Release artifacts under .forge/releases/out/<version>/ are copied verbatim to dist/releases/<version>/, but they are served as active documents:

• src/releases.rs:462-465 copies the whole tree.
• src/serve.rs:729-733 only special-cases raw/; an artifact named evil.html gets Content-Type: text/html and inline disposition.
• src/build.rs:1150 _headers protects only /raw/*; Pages serves the artifact inline too.

Reproduced

Fixture repo:

mkdir -p .forge/releases/out/v1.0
cat > .forge/releases/out/v1.0/evil.html <<'HTML'
<!doctype html><script>document.body.textContent="PWNED"</script>
HTML

Build, serve, then:

curl -I http://127.0.0.1:PORT/releases/v1.0/evil.html
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8

The script executes in the site origin (the origin that hosts the inbox).

Impact

Stored XSS via a release artifact (HTML/SVG/etc.), on hu13 serve and Cloudflare Pages.

Fix

• Treat /releases/<version>/... artifacts as downloads in serve (same policy as raw) and add a Pages _headers rule, e.g. /releases/*/* -> Content-Disposition: attachment, X-Content-Type-Options: nosniff.
• Keep /releases/<version>.html itself inline.
• Regression test: artifact .html/.svg response is attachment and application/octet-stream/safe MIME.