fix: the build stamp's check must not depend on a title attribute

Self-review of the previous commit. The assemble-stamp pattern spelled the
whole opening tag, including the title text, so a purely cosmetic edit on
ui/shell-polish -- which is rewriting this header right now -- would have
failed the assembly with a message about a missing cache-bust stamp.

`id` moves last in the tag and the pattern is `id="build-version">TOKEN<`,
which still verifies the token is inside that element and nothing else.
Re-proved discriminating by injecting the missed substitution: exit 1 with
`assemble: refusing to ship; unstamped: .../app/index.html`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FC2jVn8Au7E9JPkw6bwXXH

web/index.html

@@ -44,7 +44,7 @@
         or commit it assembled from (improvise-oujb). A page served straight
         out of web/ was never assembled and honestly says so.
       -->
-      <span id="build-version" title="Build this page was assembled from">unstamped</span>
+      <span title="Build this page was assembled from" id="build-version">unstamped</span>
     </header>
 
     <!--