[SandObserver]

Summary

• --check computed the correct hash for every asset reference and detected that the file differed, but only added it to a counter. The single failure condition was a reference with no ?v= at all, so a stale stamp passed.
• Collect those references in check mode and fail on them, naming the reference and the hash its content now has.
• Change the success line to "every asset reference is stamped and current", which is what it now verifies.
• Add a test that copies ui/ and scripts/ to a temporary tree, breaks one stamp and asserts the check exits non-zero.

Effect of the bug: editing a stylesheet or module without restamping produced a reference naming content the file no longer had. Browsers kept serving the cached copy, leaving a page running a mix of versions after an upgrade. This is the same failure the unstamped-reference check already existed to prevent.

Testing
All green: 1184 backend tests, 802 frontend, lint, format, both typechecks and the cache-busting check. The new test was confirmed to fail with the fix reverted and pass with it, so it is not vacuous. Verified separately that the stricter check passes against the current main tree, so it does not fail CI on existing content.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.