fix(deploy): port catalog generator + drift-check to Python (prod has no node)

The host-side generator ran 'node scripts/*.mjs' in deploy.sh, but the prod box
has python3 only (no node outside containers), so the site deploy failed at the
generation step. Reimplemented both in Python (byte-identical output, verified
via diff against the node version; matches scripts/sync_nav.py tooling).

scripts/check-service-catalog-drift.py

@@ -0,0 +1,73 @@
+#!/usr/bin/env python3
+"""Drift guard: the site's generated catalog MUST match the API source.
+
+Run in deploy.sh before the site build. Re-parses the API catalog and compares
+it to the committed site/src/lib/service-catalog.generated.ts. Exits 1 on any
+difference, so a price edited in the API but not regenerated (or a hand-edited
+generated file) is caught before it reaches customers.
+
+Usage: python3 scripts/check-service-catalog-drift.py
+"""
+import re
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT / "scripts"))
+import importlib.util
+
+spec = importlib.util.spec_from_file_location("gen_catalog", ROOT / "scripts/gen-service-catalog.py")
+gen = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(gen)
+
+GEN = ROOT / "site/src/lib/service-catalog.generated.ts"
+
+
+def parse_generated(ts: str) -> dict:
+    m = re.search(r"export const SERVICE_META[^=]*=\s*\{(.*)\n\};", ts, re.S)
+    if not m:
+        raise SystemExit("drift-check: cannot parse generated SERVICE_META")
+    body = m.group(1)
+    out = {}
+    for em in re.finditer(r'"([a-z0-9\-]+)":\s*\{(.*?)\},', body):
+        slug = em.group(1)
+        inner = em.group(2)
+        name_m = re.search(r'name:\s*"((?:[^"\\]|\\.)*)"', inner)
+        price_m = re.search(r"price_cents:\s*(\d+)", inner)
+        gov_m = re.search(r'gov_fee_label:\s*"((?:[^"\\]|\\.)*)"', inner)
+        entry = {"name": gen._unescape(name_m.group(1)), "price_cents": int(price_m.group(1))}
+        if gov_m:
+            entry["gov_fee_label"] = gen._unescape(gov_m.group(1))
+        out[slug] = entry
+    return out
+
+
+def main() -> int:
+    api = gen.parse_catalog(gen.SRC.read_text())
+    have = parse_generated(GEN.read_text())
+    problems = []
+    for slug, a in api.items():
+        g = have.get(slug)
+        if not g:
+            problems.append(f"{slug}: missing from generated file")
+            continue
+        if a["price_cents"] != g["price_cents"]:
+            problems.append(f"{slug}: price API={a['price_cents']} generated={g['price_cents']}")
+        if a["name"] != g["name"]:
+            problems.append(f"{slug}: name mismatch")
+        if a.get("gov_fee_label") != g.get("gov_fee_label"):
+            problems.append(f"{slug}: gov_fee_label mismatch")
+    for slug in have:
+        if slug not in api:
+            problems.append(f"{slug}: in generated file but not in API")
+    if problems:
+        print("SERVICE CATALOG DRIFT DETECTED (run: python3 scripts/gen-service-catalog.py):", file=sys.stderr)
+        for p in problems:
+            print("  - " + p, file=sys.stderr)
+        return 1
+    print(f"drift-check: OK -- {len(api)} services, API and generated catalog match.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())