Recurse into book subdirs; two-way site cross-check

Apply second review of the books branch. The headline bug: the
non-recursive glob never saw the two re-read reviews nested under
_books/<book>/, so their exclusion from AT records was an accident.
Sources are now collected recursively like Jekyll (skipping _-prefixed
template dirs), and re-reviews are skipped by an explicit rule: books
with canonical_url front matter get no record — the canonical page
owns the document.

Changes:
- _collect_documents: single shared pipeline for publish and validate
  (parse errors, null/empty titles, publishedAt, duplicate paths); a
  null title: no longer stringifies to "None" and slips the guard.
- validate --site-dir is two-way: a reverse sweep requires every
  depth-1 built page under /blog/ and /books/ to have a record, with
  SITE_SWEEP_SKIP for pagination/listing pages and content detection
  for redirect stubs. Verified green against the real 230-document
  build in both directions.
- Missing --posts-dir/--books-dir/--site-dir is an error; a typo'd
  path used to validate nothing and exit green.
- New delete-orphans subcommand (manual only): lists remote records
  with no local document, deletes only with --yes; deleteRecord added
  to the client. Recovery path for bad records, since on main the
  publish step necessarily precedes the cross-check.
- validate requires --books-dir at the CLI, matching publish.
- Non-mapping front matter is a per-file error, not a traceback;
  stale docstrings/help texts fixed; unused test imports removed.
- Correct bluesky.md book count (125 canonical, not 129) and document
  the above as Phase 6.5.

Author: agude