A test pins /robots.txt and /sitemap.xml: public repositories listed with lastmod, private never, and If-None-Match answers 304 #6626

Intent: the forge's crawler surfaces (sitemapXml and robots in src/web/standards.ts) have no test of their own. A private repository leaking into the sitemap would go unnoticed.

Done:

• [ ] A new test/standards-sitemap.test.ts on a test forge with one public and one private repository. The sitemap lists /, /explore and the public repository, with a <lastmod> once the repository has a push. It never lists the private one.
• [ ] A second GET with the ETag in If-None-Match answers 304 with an empty body. After a push to the public repository, the ETag changes.
• [ ] /robots.txt disallows /signin, /signup, /settings, /search and /api/, and names the sitemap on the request's origin.
• [ ] If a case fails today, the same pull fixes src/web/standards.ts and says so.
• [ ] bun test test/standards-sitemap.test.ts passes.

Files: test/standards-sitemap.test.ts, src/web/standards.ts