Stamp the build into the output, not into a tracked file

The stamping scheme was wrong in a way worth recording. tools/stamp.js rewrote
src/build-info.js before every serve and build, so after each commit the
committed stamp named the *previous* commit — as it does right now, reading
76072ed+ while HEAD is 5c1784d — and the next serve rewrote it and dirtied the
tree again. A generated value does not belong in a tracked file if anything
routinely regenerates it.

src/build-info.js is now permanent and reads `commit: 'dev'`. tools/build.js
substitutes the real commit into the bundled output only, and fails loudly if
the substitution finds nothing to replace. So dist/theladder.html names the
commit that produced it, running from source honestly reads "0.3.0 · dev", and
the working tree never churns. tools/stamp.js is gone and `npm run serve` is a
plain static server again.

Also here, for picking this up later: a "Where things stand" section in the
README with the five open questions in the order they are likely to matter —
whether money stops mattering late, the negotiation gate that four early options
sit behind, the feedback widget nobody uses, how thin Dispatch is next to the
mailroom, and third-tier versus second-pack.

121 tests. docs/DECISIONS.md §25 corrected to describe what the code now does.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VMSFHyVPitUoosW5wyEADj

docs/DECISIONS.md

@@ -320,15 +320,22 @@ Playtest: *"need entry on the main screen showing what version we're running…
 so it's easy to tell when new stuff is."*
 
 A status line at the top of every screen names the game, the pack, the player's
-current title, and the version plus the commit it was built from. `tools/stamp.js`
-writes the commit into `src/build-info.js` before serving and before building,
-so a distributed `dist/theladder.html` states exactly which commit produced it,
-and a dev session says so too. A working tree with uncommitted changes gets a
-`+` suffix — "4cab9fc+" is honest in a way that a bare SHA would not be.
+current title, and the build.
 
-The file is tracked rather than generated-and-ignored so a fresh clone runs
-without a build step first. It changes at most once per commit, and the stamper
-ignores a same-commit restamp so a running server does not churn the tree.
+`src/build-info.js` is tracked and permanently reads `commit: 'dev'`; it is
+never rewritten. `tools/build.js` substitutes the real commit into the *bundled
+output* only, so `dist/theladder.html` states exactly which commit produced it
+while the working tree never churns. A build from a dirty tree gets a `+`
+suffix — "5c1784d+" is honest in a way a bare SHA would not be, and the build
+fails loudly if the substitution finds nothing to replace.
+
+Running from source therefore reads "0.3.0 · dev", which is what it is.
+
+The first attempt stamped the tracked file in place before every serve and
+build. It was wrong in a way worth recording: after each commit the committed
+stamp named the *previous* commit, and the next serve rewrote it and dirtied the
+tree. A generated value does not belong in a tracked file if anything routinely
+regenerates it.
 
 ## 26. The whole game is playable from the keyboard