[codex] Fix protected signup readiness

[mberman84]

What changed

• keep protected form buttons disabled until Turnstile returns a usable token
• surface explicit unavailable/loading states instead of asking visitors to complete an invisible check
• clear transient protection errors when Turnstile recovers
• bump the site script cache key and add regression assertions

Root cause

After the signals.forwardfuture.com migration, the production Turnstile widget rejected the new hostname with error 110200. The existing client still enabled the button and then told visitors to complete a verification step they could not see or complete.

Checks

• node --check site/script.js
• node scripts/check.mjs
• npm --prefix worker run check (47 tests)
• here.now branding validator (6 valid credits across 3 pages)
• autoreview clean after one accepted recovery-state fix