tests: cover exports, check-links, sync-counts, new-entry and the client search

[TMHSDigital]

Why it matters
The checks and library modules are well tested (site/checks.test.mjs, site/lib/lib.test.mjs), but several scripts that rewrite the repo or publish data have no tests. The bugs filed alongside this issue (feed author, llms regex, CSV cells, NUL loop) were all untested paths.

Gaps found

• site/lib/exports.mjs: tests (lib.test.mjs:521-529) cover quoting, ordering and skipping deprecated entries only. There are no tests for the Atom required elements, the entry limit, empty input or formula-leading cells.
• site/check-links.mjs: top-level code, untestable as written (see the hardening issue).
• site/sync-counts.mjs: its regex $1${n} replacements rewrite README and category files, and nothing tests them.
• site/new-entry.mjs: untested. It also throws a raw ENOENT when a category exists in config but catalog/<cat>/ doesn't (:47).
• site/build.mjs main() (loadEntries, licenseFamily, sitemapXml, robotsTxt) and site/validate.mjs checkRelativeLinks.
• Client JS (site/public/app.js search and readUrl, shortlist.js, not-found.js suggestions) has no tests. Search ranking and word-boundary matching (ui: search matches inside words ("ui" matches "build", "art" matches "earth") #16, ui: search is slow per keystroke (1s+ on throttled CPU) #17) could regress without anyone noticing.
• No adversarial tests for renderInline, absoluteLinks or llmsFullTxt (balanced parens, NUL, control characters).

Suggested approach
Stay dependency-free with node:test. Extract pure functions from the CLIs (sync-counts, new-entry, check-links) and from app.js (search scoring, URL parsing) into importable modules, and test those. Add node --test to npm test and CI.

Done when
Each module above has at least one test of its main behaviour and one edge case, and CI runs them.

[TMHSDigital]

Partly done in #76. Now tested: the Atom required elements, feed limit and empty input, CSV cells that start with a formula character, NUL and balanced-paren cases in renderInline and llmsFullTxt, link-check classify/siteOf/reportUrl, the shared entry walker, and the V16 private-host rule. Still untested: client JS (app.js search and URL params, shortlist.js, not-found.js), sync-counts.mjs and new-entry.mjs.