Fail CI when the committed plugin bundle is stale

[Railly]

Context

main.js is committed and shipped, but CI only runs the build. It does not verify that rebuilding leaves the committed bundle unchanged. Recent PRs passed their source checks while omitting the regenerated bundle.

Task

After the production build, fail CI when main.js differs from the committed version.

Acceptance criteria

• CI runs the production build and checks git diff --exit-code -- main.js.
• A source-only change that affects the bundle fails until main.js is regenerated.
• A correctly regenerated bundle passes.
• Release continues to build and attest the same artifact.