feat: author-fixed and hidden tutorial variables

[jung-thomas]

Closes #2852.

What

Tutorial authors can now set a variable's value once and/or hide it from the reader, extending the #2811 tutorial-variables feature. Two new optional frontmatter fields on a variable:

• value: <string> — an author-fixed literal, substituted everywhere. Change it in one place, it updates across the whole tutorial.
• display: <bool> — whether to show the reader-facing input. Defaults to true (shown). false hides the input; the value still substitutes into the body.

Precedence for the substituted value: value > default (regex) > reader input / stored > empty. A literal value overrides a regex default.

Behavior matrix

value	display	Reader sees input?	Substituted value
set	false	no	the literal value
set	true/omitted	yes, pre-filled, editable	value, overridable by reader
unset	false	no	identity default regex, else empty
unset	true/omitted	yes	reader input / identity default (today's behavior)

Example (hidden author-fixed):

variables:
  - name: productVersion
    type: string
    value: "MyApp 2.0"
    display: false

How

• scripts/parsers/variables.ts — value?/display? on TutorialVariable; validate (display must be boolean, value must be string); label now optional when display:false, still required when displayed.
• scripts/parsers/types.ts — source-frontmatter shape widened.
• render-frontmatter.ts emits the fields verbatim (no code change; guard test added).
• hugo-apps/src/tutorial-variables/ — new resolveInitial() (value > default); island renders inputs only for display !== false and seeds every variable (hidden literal values substitute with no input).
• Docs: docs/authors/writing-tutorials.md §3.7 + variables.ts doc-comment.

Tests

71 passing across 5 variable suites (parser validation, compose carry-through, frontmatter emit, island pure helpers, island component mount). XSS-safe (applyValue uses textContent), backward-compatible (no new field ⇒ unchanged behavior).

Fresh whole-branch review (separate model): no Critical/Important findings.

Notes / follow-ups

• Displayed-var precedence nuance: for a displayed variable with both a persisted reader value and an author value, the persisted value wins (reader-owned). An author who wants a value to always win should use display: false. value unconditionally wins only for hidden variables.
• value: "" (empty string) is treated as "no value" (falls through to default/empty) — deliberate, tested.
• The canonical demo tutorial (use-variables-in-tutorials) is generated from the sap-tutorials source repo; exercising a hidden/fixed variable there is a separate source-repo change.

🤖 Generated with Claude Code