Show the rules a stale stylesheet differs in (closes #231)

The css-check stage splits both stylesheets after each "}" and prints
their diff, so a failure names the rules that differ instead of a
character position.

The check workflow's fingerprint comment and build step name now
include the stylesheet check, as the README does. The README's
Stylesheet section names internal/handlers/recent_events.go among the
files to edit.

Model: opus-5-5

README.md

@@ -1398,13 +1398,13 @@ the `dist.integrity` hash listed at
 ## Stylesheet
 
 `static/css/tailwind.css` is generated by Tailwind and committed. To change the
-styles, edit the templates, `static/js/app.js` or `static/css/input.css`, run
-`make css`, and commit the regenerated file with the change. Tailwind takes
-classes only from the files that `input.css` names in its `@source` lines; a
-class written in any other file is not generated until that file is named there
-too. `make check` and the image build fail when the committed file differs from
-what `make css` generates. `static/css/style.css` is hand-written and is not
-generated.
+styles, edit the templates, `static/js/app.js`,
+`internal/handlers/recent_events.go` or `static/css/input.css`, run `make css`,
+and commit the regenerated file with the change. Tailwind takes classes only
+from the files that `input.css` names in its `@source` lines; a class written in
+any other file is not generated until that file is named there too. `make check`
+and the image build fail when the committed file differs from what `make css`
+generates. `static/css/style.css` is hand-written and is not generated.
 
 `make css` runs the Tailwind standalone CLI in Docker, at the version and sha256
 pinned in the Dockerfile's stylesheet stages; it is never installed on the host.