Keep runtime provider secrets out of validation-only web builds

For Next.js validation builds that do not publish a deployable artifact, runtime provider authorization often is unnecessary. Trace import-time URL/key validation and lazy client initialization, then supply literal synthetic values and an unreachable local destination instead of Supabase privileged credentials. Prove compilation with a scrubbed environment and external network denial; disclose font-only fixtures when Google Fonts would otherwise fetch during build. Keep deployment configuration separate. The result demonstrates build compatibility without live app credentials, not runtime readiness, immutable protection against workflow edits, or safety of unrelated dependency-install tokens.

Applies when: a pull-request web build validates source without producing a deployed artifact. Keywords: Next.js Supabase GitHub Actions build validation credentials synthetic Google Fonts