feat: #3616090 Repoint the blog view and its Canvas content templates to the site template theme

Issue: #3616090 Initialize the RightUp site template recipe and start the 1.0.x branch

The recipe carried no theme-repointing actions, so configuration that arrives from varbase_blog_base kept naming the base theme:

• views.view.blog bound its all, latest and related displays to vartheme_bs5:grid, vartheme_bs5:views-view-grid and vartheme_bs5:views-view-unformatted.
• All 19 canvas.content_template.node.blog.* referenced 13 distinct vartheme_bs5:* components that do not exist on a RightUp site.

Blog article pages returned HTTP 500 with AssertionError: assert($component instanceof Component) from Drupal\canvas\Plugin\Field\FieldType\ComponentTreeItemList line 479, and the Home and Blog pages printed a Twig LoaderError where the article grid belongs.

What this adds

• views.view.blog: setViewsComponentStyleTheme with theme: default, plus the three per-display component_id values as dotted leaf paths, so the options the base recipe set are not replaced.
• repointComponentTreeToTheme with theme: default on each of the 19 blog content templates.
• An explicit drupal/varbase_recipes requirement. It provides both config action plugins and was reaching a site only through the base project's lock file, which is what makes a require onto another codebase abort with PluginNotFoundException.

Same shape the sibling site templates already use.

Verified

Re-installed on Varbase 11 from a dropped database, through drush site:install varbase installer_site_template_form.add_ons=rightup, exit 0:

• zero configuration objects still naming vartheme_bs5:
• views.view.blog displays now vartheme_bs5_rightup:grid, :views-view-grid, :views-view-unformatted
• 12 of 12 blog article pages return 200, previously 0 of 12
• all 5 Canvas pages return 200, and the Twig LoaderError is gone from Home and Blog
• zero error-severity watchdog rows

Notes on two things that are not settled

• The drupal/varbase_recipes: 1.0.x-dev constraint is the maintainer's explicit choice. It is consistent with the other Varbase base recipes this file already pins, and worth reading together with #3620120: the existing dev pins are why a bare composer require drupal/rightup:1.0.x-dev fails against a codebase whose lock holds the released base recipes, and -W is currently needed on that path. This change adds one more pin of the same kind.
• A separate installer failure on a hand-built codebase is NOT root-caused. Requiring the recipe from a local vcs clone of a dev branch left /core/install.php as a bare "Error" page with TypeError: Drupal\RecipeKit\Installer\Hooks::getRecipePath(): Return value must be of type string, null returned, after drupal/core-recipe-unpack removed drupal/rightup from the root composer.json and the lock while leaving it in vendor/composer/installed.php. The verification above is on a project built by the workspace builder, requiring drupal/rightup:1.0.x-dev from packages.drupal.org. The hand-built path is not verified and is not claimed to be.

AI-Generated: Yes

Checkpoints:

• File an issue
• Addition/Change/Update/Fix
• Testing to ensure no regression
• Automated unit testing coverage
• Automated functional testing coverage
• UX/UI designer responsibilities
• Readability
• Accessibility
• Performance
• Security
• Developer Documentation
• User Guide Documentation
• Reviewed by human
• Code review by maintainers
• Full testing and approval
• Credit contributors
• Review with the product owner
• Release notes snippet
• Release