feat(csr): version drift detection between SDK and worker

[nicklasl]

Depends on #412 — merge that first.

Summary

• Detect stale self-hosted worker files using a content hash instead of version numbers
• build-worker.mjs computes a SHA-256 hash of the bundled worker code and writes it to worker-hash.ts
• emit-worker-file.mjs prepends globalThis.__WORKER_HASH__ to the standalone file
• Worker reads the hash from globalThis and sends it in the welcome message
• Tab imports the precomputed hash and compares on welcome — mismatch logs a warning via debugLogger, recording still proceeds
• Hash check only fires for self-hosted workers (urlScheme === 'custom') — inlined workers (data:/blob:) can't drift

Why hashes instead of versions

csr-common and session-recording have independent version numbers. Using either package's version for the drift check would show a version the customer doesn't recognize. A content hash sidesteps versioning entirely — if the worker code changed, the hash changed, regardless of which package bumped.

Test plan

• workerHash included in welcome when globalThis.__WORKER_HASH__ is set
• workerHash is undefined when not set (inlined worker path)
• Mismatch warning logged when urlScheme === 'custom' and hashes differ
• No warning when hashes match
• No warning for data:/blob: URL schemes
• No warning when workerHash absent (graceful degradation for old workers)
• Build produces standalone file with hash prepended
• Full CSR test suite passes (142 tests)

🤖 Generated with Claude Code