make css now runs the Tailwind v4.2.1 standalone CLI in a docker build
stage, the binary pinned by sha256, instead of whatever tailwindcss is
on the host. A css-check stage, run by make check and required by the
image build, fails when static/css/tailwind.css differs from what make
css generates.
input.css now names its sources (the templates, app.js, and the Go file
that picks status colour classes) instead of letting Tailwind scan the
whole checkout, where words in Go code and docs became unused classes.
.btn-text is removed and tailwind.css regenerated; it only loses unused
rules.
Model: opus-5-5
The build no longer downloads Alpine.js. Its npm package tarball is committed as 3p/alpinejs-3.14.9.tgz, byte for byte the file script/fetch-assets downloaded, with the sha256 that script pinned. script/assets (make assets) extracts package/dist/cdn.min.js to the ignored static/js/alpine.min.js; script/test runs it, so make test, make check, the pre-commit hook and the Dockerfile get the file with no network access, and make build, run and dev run it too.
Removed: script/fetch-assets, its Dockerfile step, static/vendor.sha256 and static/vendor_test.go. The README describes the new flow.
Model: opus-5-5