fix(build): fail the build when an @include marker is missing

[netravnen]

INCLUDE_RE.sub never asserted that it matched anything, so a .src.js that
lost its /* @include admincom-common.js */ marker built clean. The
generated file passed node --check -- the syntax is valid, the references
are not -- the script reported "up to date", and the userscript threw
ReferenceError in the browser on first use, because dbg, fetchWithRetry
and the rest of the shared fragment were silently never inlined. Merging
to master is the deploy for this repo, so that reaches every admin before
anyone notices.

Every script here depends on the shared fragment, so zero markers means
the marker was lost, not that a script genuinely needs no lib. The guard
says so and names where to record the exception if one ever does.

Changes:

• render() uses INCLUDE_RE.subn and raises ValueError on zero
  substitutions, naming the source file and what would have gone wrong.
  The error propagates out of main() before anything is written, so a
  failed build leaves no partially generated file behind.
• New tests/build-include-marker.test.js covers the failure case and,
  just as importantly, the success case actually inlining the lib -- a
  guard test that only checks the error path cannot tell a working build
  from a broken one.
• One case asserts the two build guards stay distinguishable: both run
  over the same sources, and a missing marker must not be diagnosed as a
  version problem.

Security:

• N/A -- build-time only, no product-facing behavior change.

Testing:

• node --test: 544 tests, 543 pass, 1 skipped (live tests are opt-in).
• Fixtures and the spawn harness come from tests/helpers/build-script-
  runner.js, shared with the @Version parity tests. Its defaults produce
  a well-formed single-script repo, so a fixture built to exercise one
  guard does not trip the other.
• Guard reverted to the old sub() call and confirmed red.
• build_userscripts.py --check still reports all three up to date, so the
  guard does not fire on the real sources.

Backwards Compatibility:

• A source with a marker builds byte-identically; all three generated
  files are unchanged. Only the previously silent zero-marker case
  changes, from success to a named failure.

Assisted-by: Claude:claude-opus-5

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}