feat(build): build-aiui.sh rejects a prod bundle carrying mock hosts

W1.7's regression gate: after 8329b826's tree-shake fix, this makes the
mock-quarantine load-bearing — a future change that reintroduces the mock
modules into the production graph fails the build instead of shipping
silently. The demo-site build (VITE_DEMO_CONTENT=true) is exempt by design.

Co-Authored-By: Claude <noreply@anthropic.com>

scripts/build-aiui.sh

@@ -94,6 +94,22 @@ verify_dist() {
         return 1
     fi
 
+    # Mock quarantine (operator decision 2026-08-07, enforced 8329b826):
+    # production bundles must carry NO mock content hosts. The demo site's
+    # content pack builds with VITE_DEMO_CONTENT=true and legitimately
+    # contains them — skip this check for that build.
+    if [ "${VITE_DEMO_CONTENT:-false}" != "true" ]; then
+        local mock_hits
+        mock_hits=$(grep -rl -e 'spotify\.com/track/example' -e 'cloud\.example\.com' \
+            -e 'plex://play' -e 'image\.tmdb\.org' "$AIUI_DIST" 2>/dev/null || true)
+        if [ -n "$mock_hits" ]; then
+            echo "FATAL: production bundle contains mock content hosts" >&2
+            echo "       (mocks are demo-site-only per the 2026-08-07 operator decision):" >&2
+            echo "$mock_hits" | sed 's/^/       /' >&2
+            return 1
+        fi
+    fi
+
     # Attribute this build to THIS repo's own current commit (D-19: no
     # second-repo pin file — this repo's own commit IS the answer now).
     local commit_sha