Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

Makefile

@@ -1,26 +1,21 @@
-.PHONY: bootstrap setup assets test lint fmt fmt-check check build run dev deps docker clean hooks css version
+.PHONY: bootstrap setup assets test test-browser lint fmt fmt-check check build run dev deps docker clean hooks css css-check version
 
 # Default target
 .DEFAULT_GOAL := check
 
 # Version stamped into the binary. Derived from git by script/version;
-# override it (`make build VERSION=v1.2.3`) where git metadata is
-# unavailable, which is how the Dockerfile passes its build arg in.
+# override it (`make build VERSION=v1.2.3`) to stamp a given value, which is
+# how the Dockerfile passes its build arg in.
 VERSION ?= $(shell script/version)
 
-# An empty override (`make build VERSION=`, or a `--build-arg VERSION=`
-# landing on the Dockerfile's `make build VERSION="$VERSION"`) means unset,
+# An empty override (`make build VERSION=`, or the Dockerfile's `make build
+# VERSION="$VERSION"` when no VERSION build arg was given) means unset,
 # exactly as it does in script/version -- stamping "" would leave the binary
 # reporting no version and the footer back on its "dev" fallback. `override`
 # is required: a plain assignment loses to the command-line definition it
 # exists to correct.
 override VERSION := $(or $(strip $(VERSION)),$(shell script/version))
 
-# Extra linker flags for the build target. The static relink in the
-# Dockerfile adds -extldflags here rather than passing its own -ldflags,
-# so composing flags cannot drop the version stamp.
-GO_LDFLAGS ?=
-
 bootstrap:
 	@script/bootstrap
 
@@ -28,11 +23,14 @@ setup:
 	@script/setup
 
 assets:
-	@script/fetch-assets
+	@script/assets
 
 test:
 	@script/test
 
+test-browser:
+	@script/test-browser
+
 lint:
 	@script/lint
 
@@ -45,13 +43,17 @@ fmt-check:
 check:
 	@script/check
 
-build:
-	go build -ldflags '$(strip -X main.version=$(VERSION) $(GO_LDFLAGS))' -o bin/webhooker ./cmd/webhooker
+# Built with cgo off, -trimpath and -s -w, as the Go Dockerfile in
+# REPO_POLICIES.md does: the binary carries no build paths, symbol table or
+# debug information, and on Linux, the image's included, it is statically
+# linked.
+build: assets
+	CGO_ENABLED=0 go build -trimpath -ldflags '-s -w -X main.version=$(VERSION)' -o bin/webhooker ./cmd/webhooker
 
 run: build
 	./bin/webhooker
 
-dev:
+dev: assets
 	go run ./cmd/webhooker
 
 deps:
@@ -71,4 +73,7 @@ hooks:
 	@script/install-precommit
 
 css:
-	tailwindcss -i static/css/input.css -o static/css/tailwind.css --minify
+	@script/css
+
+css-check:
+	@script/css-check