Turn generated-content fast path ON by default (Workstream C follow-up)

[jung-thomas]

Draft — for work tomorrow. Makes the slug-targeted generated-content fast path the default. It's built + PROD-proven (2026-08-25: warm fetch ~56s → ~11s, 1404 tutorials reused, one regenerated) but currently opt-in (content-cache input default: false).

Plan doc in this PR: openspec/changes/slug-targeted-delta-rebuild/content-cache-default-on.md.

What this needs

1. Byte-identical diff guard (task 3.6 — do first, the safety gate): harness that diffs FULL-regen vs FAST-PATH hugo/public for a changed slug + sample reused pages, byte-for-byte; wire into CI. Must be green before flipping the default.
2. Workflow wiring: flip content-cache input default: false → true (keep -f content-cache=false opt-out) and fix the repository_dispatch path — CONTENT_CACHE_FAST_PATH at :419 reads only inputs.content-cache, so repository_dispatch (the real author hotfix trigger) always resolves false and never gets the fast path. Compute fast_path = (effective_mode=='slug-targeted') && (content-cache!='false') in the "Determine effective rebuild mode" step and reference it for both the env var (:419) and the cache SAVE if: (:378). Prime the sidecar on full rebuilds too so hotfixes stay warm.
3. Mirror to rebuild-content-qa.yml (task 3.8).

Verify before merge

• Diff guard green; DEV A/B on a repository_dispatch hotfix shows fast path ENABLED; negative test confirms a parser/feed change forces full regen.

Safety

decideFastPath already fails open — fast path fires ONLY when slug-targeted + valid sidecar + feed-fingerprint match; else full regen. Full/catalog runs never use it. Rollback: -f content-cache=false or revert the default flip.

No code changes yet — this PR carries the plan; implementation lands tomorrow.