Stale-frontend footgun: cdk deploy ships whatever web/dist-lambda is on disk

Code.fromAsset(web/dist-lambda) has NO build step in synth — deploying after a merge silently ships a stale frontend (caught live: P6.3 islands deploy served the morning P6.2 build, zero script tags; SSR worked so it LOOKED fine). check-astro-ssr-bundle.sh DOES fresh-build (so gates pass while the deployable is stale — gate checks source, asset ships disk). Durable fix options: (a) fromAsset bundling that runs astro build + build-lambda.mjs inside synth (deterministic, slower synth), (b) pre-deploy freshness check: hash web/src+config into dist-lambda/.build-hash, refuse deploy on mismatch. Interim rule: ALWAYS run check-astro-ssr-bundle.sh (fresh build) immediately before any deploy touching web.