chore(creator-studio): stop tracking the build output

assets/creator-studio/build is generated by `npm run build`, so committing it
put a rebuilt bundle in every diff. It now follows the same deploy-only rule
as assets/admin/build.

- Root .gitignore ignores build/* and node_modules/, keeping a .gitkeep so
  the directory still exists in a clean checkout.
- Drops the three tracked artifacts from the index.
- The contract test no longer requires the artifacts to exist; it checks the
  set is all-or-nothing, so a clean checkout and a locally built tree both
  pass. This mirrors admin-build-graph-contract.
- README documents that build/ is produced on the target machine.

887 widget-system tests pass.

tests/widget-system/creator-studio-contract.test.cjs

@@ -380,9 +380,15 @@ test('quote, hidden content, and block math render like the live article', () =>
 test('creator studio build artifacts and contracts exist', () => {
 	assert.ok(exists('assets/creator-studio/package.json'));
 	assert.ok(exists('assets/creator-studio/package-lock.json'));
-	assert.ok(exists('assets/creator-studio/build/index.asset.php'));
-	assert.ok(exists('assets/creator-studio/build/index.js'));
-	assert.ok(exists('assets/creator-studio/build/index.css'));
+	assert.ok(exists('assets/creator-studio/build/.gitkeep'));
+	// build/ is gitignored and deploy-only (same as assets/admin/build); when a
+	// local build is present, all three entry artifacts must be there together.
+	const built = ['index.asset.php', 'index.js', 'index.css'];
+	const present = built.filter((file) => exists(`assets/creator-studio/build/${file}`));
+	assert.ok(
+		present.length === 0 || present.length === built.length,
+		`build/ is partially built: ${present.join(', ')}`
+	);
 	assert.ok(exists('assets/js/protected-download.js'));
 	assert.ok(exists('src/Core/PreviewToken.php'));
 	assert.ok(exists('src/Admin/Native/SubmissionReview.php'));