Stop tracking generated sources; sync them in the Connect release update

[callumalpass]

The schemas, contracts, conformance data and theme files written by pnpm sync:sources were committed, but ci.yml and deploy.yml regenerate them from the refs in site-sources.json before every build. The committed copies therefore never reached production and drifted silently; the Connect schemas went unsynced from #20 until #79. site-sources.json is now the only source of truth.

• .gitignore now covers every sync output, and 224 generated files are untracked.
• connect/schemas/contract-extension.v1.schema.json stays tracked. Connect removed it in Implement first-class data contract access mdbase-connect#99, so the site only serves it because it's committed, and this keeps its public URL.
• Update Connect release generates the release record first, since that moves the Connect ref to the tag. It then checks out every pinned source, builds the contracts and spec, and syncs before pnpm test. Previously it tested against whatever was committed. Generated files are ignored, so the release-only change guard is unchanged.
• The README says the files are generated and that site-sources.json controls what's published.

Verified in a fresh clone with sources checked out at the pinned refs. sync:sources leaves git status clean, and pnpm test passes in full (spec, home, docs, release checks, astro check, build, spec import, links). The built mdbase-app.schema.json, contracts/catalog.json and mdbase-theme.css are byte-identical to production. The kept schema, the mdbase-app.v1.json alias and the rc.18 pack are present.