Drafts with a well-formed `share` token in frontmatter ship to prod at
/blog/d/<slug>-<token>: robots noindex/nofollow, no OpenGraph, token
re-checked at render so a guessed slug renders nothing, tokenless drafts
get no unlisted path. Article markup factored into a shared PostArticle;
the public listing and /blog/[slug] keep filtering drafts out.

Also: static export requires at least one prerendered variant per dynamic
route, and prod currently has zero published posts — emit a 404 sentinel
param so the export still ships (build broke at HEAD for this reason).