feat: attach the assembled site to every release, and let the page name its build

improvise-oujb. A tagged release carried four native tarballs and nothing for
the web; the site shipped only by ci.yml's pages-deploy, on a push to main.

Pages keeps tracking main (user, 2026-09-22: "I like Pages showing the latest
main for now"), so this is a CAPTURE, not a second deployment: the tarball is a
self-hostable copy of the site as of the tag and a rollback target, not what a
visitor to the published site is running. pages-deploy is untouched.

Mechanism is dist's own [[dist.extra-artifacts]], so it survives `dist init`:
`dist plan` under the pinned 0.30.4 lists improvise-web.tar.gz beside the four
platform tarballs and `dist generate` leaves release.yml byte-identical. The
build command is scripts/build-web-release.sh, which calls web/build.sh and
web/assemble.sh -- the same two scripts ci.yml and a developer run, so there is
no second way to build the bundle. Its toolchain pins come from
scripts/web-toolchain-versions.env, which ci.yml's build job now reads too.

`github-build-setup` was measured and does NOT help: it injects into
build-local-artifacts only, which is the wrong job for a global artifact.

The page now names the build it was assembled from in #build-version, stamped
by web/assemble.sh with the same token as the bundles and verified by the same
scripts/assemble-stamp.sh gate. An unassembled tree honestly reads "unstamped".

Verified by running `dist build --artifacts=global` locally: the script ran,
the site assembled, and dist placed improvise-web.tar.gz in target/distrib.
Not verified: a real tag push, which would require cutting a tag.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FC2jVn8Au7E9JPkw6bwXXH

web/assemble.sh

@@ -62,6 +62,13 @@ rm -f "$app/worker-pkg/.gitignore" "$app/worker-pkg/package.json"
 # BSD sed (macOS) needs an argument to -i; GNU sed must not be given one.
 sedi() { sed "$1" "$2" > "$2.tmp" && mv -f "$2.tmp" "$2"; }
 
+# The page must be able to say what it is: a site that cannot name its own
+# build makes every bug report about it unanswerable (improvise-oujb). This is
+# the same token the bundles are stamped with, and it is verified below on the
+# same terms, so an unstamped page is a refusal rather than a silent `unstamped`
+# on the front door.
+sedi "s|>unstamped<|>${token}<|" "$app/index.html"
+
 sedi "s|\./pkg/improvise_wasm_client\.js|&?v=${token}|" "$app/app.js"
 sedi "s|\./worker-pkg/improvise_worker_server\.js|&?v=${token}|" "$app/worker.js"
 sedi "s|'improvise_wasm_client_bg\.wasm'|'improvise_wasm_client_bg.wasm?v=${token}'|" \
@@ -74,8 +81,10 @@ sedi "s|'improvise_worker_server_bg\.wasm'|'improvise_worker_server_bg.wasm?v=${
 # `set -e` (found by Copilot on PR #24). Each stamped reference is therefore
 # verified on its own, by scripts/assemble-stamp.sh -- which is a separate
 # script so its refusals can be exercised without fabricating a web/pkg
-# (improvise-w8ih). Its argument is FILE PATTERN, four times.
+# (improvise-w8ih). Its argument is FILE PATTERN, five times -- the page's own
+# #build-version among them (improvise-oujb).
 sh "$root/scripts/assemble-stamp.sh" \
+  "$app/index.html" "id=\"build-version\" title=\"Build this page was assembled from\">${token}<" \
   "$app/app.js" "pkg/improvise_wasm_client.js?v=${token}" \
   "$app/worker.js" "worker-pkg/improvise_worker_server.js?v=${token}" \
   "$app/pkg/improvise_wasm_client.js" "improvise_wasm_client_bg.wasm?v=${token}" \

web/index.html

@@ -39,6 +39,12 @@
       <span id="mode"></span>
       <span id="hint"></span>
       <span id="status" role="status"></span>
+      <!--
+        What this page IS: web/assemble.sh rewrites the text below to the tag
+        or commit it assembled from (improvise-oujb). A page served straight
+        out of web/ was never assembled and honestly says so.
+      -->
+      <span id="build-version" title="Build this page was assembled from">unstamped</span>
     </header>
 
     <!--