…DE_ENV (#16313)

The NODE_ENV saga continues. Any build where NODE_ENV isn't `production`
currently ships with every origin check compiled out:

```js
// respond.js
if (!DEV) {
	// cross-site remote request check
	// cross-site form submission check (csrf.checkOrigin / trustedOrigins)
}
```

`DEV` comes from esm-env, which kit bundles into apps resolved by
NODE_ENV, so `NODE_ENV=staging vite build` produces a deployable server
with CSRF protection silently disabled. Vite's docs list non-production
builds as a supported workflow, and khromov raised this exact failure
mode in #14335 when the gate was added. At the time `DEV` was assumed to
only mean `vite dev`, which the esm-env consolidation in #14308 no
longer guarantees (first leak #15632, fixed by #15852, second leak
#16008, fixed by #16023).

This applies the rule from the #15852 body ("reverting to the global
constant where we want the code to only run during `vite dev` ... Every
other place that uses DEV is meant to fire warnings ... and that should
still happen if the user did `NODE_ENV=development vite build`") to two
sites it missed:

- the `respond.js` gate, `!DEV` to `!__SVELTEKIT_DEV__`, covering both
the form CSRF check and the remote functions origin check that now
shares it
- the live-serving condition in `app/server/remote/prerender.js`, same
one-token swap (prerendered remote functions were served live in these
builds)

The three validation `DEV` sites in `respond.js` (`validateHeaders`,
`page_nodes.validate()`, `validate_server_exports`) are deliberately
untouched. They are warning sites and should keep following NODE_ENV per
the rule. The check internals are also untouched, so this stays out of
the way of the `sec-fetch-site` idea in #15992.

The new spec in `test/build-errors` builds a minimal fixture with
`NODE_ENV=staging`, imports the generated server, and asserts a normal
GET returns 200 while a forged cross-site form POST returns 403. It
fails on main (the POST returns 200) and passes with the fix. The
existing basics CSRF tests stay green in both modes, and dev behavior is
unchanged.

There are HMR-coupled `DEV` gates in `client.js` and the remote query
modules from the same class. Left for a follow-up, `client.js` currently
conflicts with #16307.

---

### Please don't delete this checklist! Before submitting the PR, please
make sure you do the following:
- [x] It's really useful if your PR references an issue where it is
discussed ahead of time. In many cases, features are absent for a
reason. For large changes, please create an RFC:
https://github.com/sveltejs/rfcs
- [x] This message body should clearly illustrate what problems it
solves.
- [x] Ideally, include a test that fails without this PR but passes with
it.

### Tests
- [x] Run the tests with `pnpm test` and lint the project with `pnpm
lint` and `pnpm check`

### Changesets
- [x] If your PR makes a change that should be noted in one or more
packages' changelogs, generate a changeset by running `pnpm changeset`
and following the prompts. Changesets that add features should be
`minor` and those that fix bugs should be `patch`. Please prefix
changeset messages with `feat:`, `fix:`, or `chore:`.

### Edits

- [x] Please ensure that 'Allow edits from maintainers' is checked. PRs
without this option may be closed.

---------

Co-authored-by: Tee Ming <chewteeming01@gmail.com>