feat: attach the assembled site to every release, and let the page name its build

improvise-oujb. A tagged release carried four native tarballs and nothing for
the web; the site shipped only by ci.yml's pages-deploy, on a push to main.

Pages keeps tracking main (user, 2026-09-22: "I like Pages showing the latest
main for now"), so this is a CAPTURE, not a second deployment: the tarball is a
self-hostable copy of the site as of the tag and a rollback target, not what a
visitor to the published site is running. pages-deploy is untouched.

Mechanism is dist's own [[dist.extra-artifacts]], so it survives `dist init`:
`dist plan` under the pinned 0.30.4 lists improvise-web.tar.gz beside the four
platform tarballs and `dist generate` leaves release.yml byte-identical. The
build command is scripts/build-web-release.sh, which calls web/build.sh and
web/assemble.sh -- the same two scripts ci.yml and a developer run, so there is
no second way to build the bundle. Its toolchain pins come from
scripts/web-toolchain-versions.env, which ci.yml's build job now reads too.

`github-build-setup` was measured and does NOT help: it injects into
build-local-artifacts only, which is the wrong job for a global artifact.

The page now names the build it was assembled from in #build-version, stamped
by web/assemble.sh with the same token as the bundles and verified by the same
scripts/assemble-stamp.sh gate. An unassembled tree honestly reads "unstamped".

Verified by running `dist build --artifacts=global` locally: the script ran,
the site assembled, and dist placed improvise-web.tar.gz in target/distrib.
Not verified: a real tag push, which would require cutting a tag.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FC2jVn8Au7E9JPkw6bwXXH

README.md

@@ -85,6 +85,19 @@ carries prebuilt binaries for Linux (x86_64 and aarch64) and macOS (Intel and
 Apple Silicon), built by `cargo dist`. The current release is the `v0.1.0-rc2`
 prerelease; there is no `v0.1.0` tag yet (improvise-3tj).
 
+Each release also carries `improvise-web.tar.gz`: the assembled browser app and
+landing page, ready to serve from any static host.
+
+### The published site and the released binaries are not the same code
+
+Deliberately, and it is worth knowing before you file a bug. The site deploys
+from `main` on every merge, so it is the latest code; a release tarball is
+whatever was tagged, which may be months older. **They are different lineages.**
+The web page names the build it was assembled from in its header, so quote that
+rather than a release number when reporting something you saw in a browser.
+`improvise-web.tar.gz` is a self-hostable copy of the site as of the tag and a
+rollback target — it is not what the published site is running.
+
 ## The data model
 
 Every cell lives at the intersection of named categories and items —