hide drafts and future-dated bundles; reveal them with -dev on

A draft is now not served at all, and neither is a bundle whose date has not
arrived. The filter sits in `Site.Lookup` and `Site.Run`, which is every path to a
bundle — so the files inside an unpublished bundle inherit its status for free,
which is what ADR-0024 asks for and what the asset route was written to allow. A
test asserts the 404 for the bundle *and* its picture, and that nothing leaks into
a listing, a feed or a sitemap.

The clock is read per request rather than at startup, so a scheduled post appears
exactly when its date arrives with nothing to restart and nothing to invalidate.
That first clock read created internal/content/clock.go, which is the only place
`verify.sh` allows `time.Now` — a render that depends on the time is worth being
able to find.

`-dev on` reveals both and reparses the theme before each render. Deliberately not
a bare boolean flag: turning unpublished work into public work should not be one
fumbled argument away. A reload that fails to parse leaves the working template set
in place, so a typo shows an error rather than replacing a good set with a broken one.

internal/content/clock.go

@@ -0,0 +1,12 @@
+package content
+
+import "time"
+
+// now is the only place the engine reads the wall clock, which `verify.sh` enforces by filename: a render
+// that depends on the time is only true for a while, and that is worth being able to find.
+//
+// A variable so a test can hold time still. Nothing else assigns it.
+var now = time.Now
+
+// Now is the current time as the engine sees it, for whoever needs to date something.
+func Now() time.Time { return now() }