perf(website): cache certificate images between deploys (~25 min → ~4 min)

[felipesalinasr]

Before merging — one manual step

Neither of Felipe's stored tokens carries the workflow scope, so this PR currently contains only the code half. The workflow edit below must be added from an account/token with workflow scope (edit .github/workflows/website-deploy.yml in the web UI on this branch, or push after gh auth login with the workflow scope). Insert this step between "Fail if POSTHOG_KEY is missing" and "Build site":

      # Certificate images are expensive: every issued certificate is two big
      # satori + resvg canvases, and without this cache a fresh runner re-draws
      # the whole cohort on every deploy (~20 min of the run). The digest
      # manifest (website/.cache) decides staleness per attendee, but the skip
      # also requires the previously rendered PNGs to exist in _site/c, so both
      # are cached. The key is per-run so the post-job save always records the
      # latest state; restore falls back to the most recent previous deploy.
      # Correctness lives in the manifest digests (attendee data + renderer
      # fingerprint), and render.mjs prunes images for certificates that are no
      # longer issued, so a stale cache can never ship a wrong or revoked image.
      - name: Restore certificate image cache
        uses: actions/cache@v4
        with:
          path: |
            website/.cache
            website/_site/c
          key: cert-images-${{ github.run_id }}
          restore-keys: |
            cert-images-

Why

Every website deploy takes 21–30 minutes (last four: 27.0, 26.7, 29.6, 21.2). Almost all of it is the certificate image renderer: two large satori+resvg canvases per issued certificate, re-drawn from scratch every deploy because neither the digest manifest (website/.cache) nor the rendered PNGs (_site/c) survive between CI runs — only npm is cached.

What

1. Workflow (the block above): cache website/.cache + website/_site/c across runs. Per-run key + prefix restore-keys, so the post-job save always records the newest state and the next run restores the most recent one.
2. Code (in this PR): pruneStaleImages in lib/certs/image-cache.mjs, called after each render pass. With _site/c now persisted, images for certificates that are no longer issued would otherwise ride the cache forever; the prune deletes them. Correctness of content was already handled by the digest manifest (attendee data + renderer fingerprint), which is unchanged. The prune is safe to land before the workflow change (on a clean _site it is a no-op).
3. Tests: website/test/cert-image-prune.test.mjs (4 cases: stale pair deleted, current + non-PNG kept, dotted codes, missing dir no-op).

Verified

• npm test: 11/11 pass. Clean Eleventy build. Biome clean.

Expected effect: website deploys drop from ~25 min to ~3–4 min when few certificates changed; a renderer/template change still re-renders everything (fingerprint in the digest), which is correct.

🤖 Generated with Claude Code