v0.316.1: the asset tag actually reaches the dashboard pages

v0.316.0 shipped it dead. Every shell asked for `?v={{.AssetTag}}`, TestAssetTag_EveryShellUsesIt
passed, and the first live load through the public address rendered `/static/style.css?v=` —
EMPTY. addShellAssetData was called only by executeTemplateLang (the sign-in, claim, recovery,
guest-share and catch-all pages). The dashboard path had never needed it, because layout.html used
to ask for {{.Version}}, which baseData supplies; moving it to {{.AssetTag}} left nothing to
supply the value.

An empty buster is a CONSTANT. It would never have changed again — worse than the per-version one
it replaced, and invisible to a test that only checks the markup. executeTemplate now calls the
same function executeTemplateLang does, which is literally what the v0.255.0 comment above that
call asked for: "setting it at the single choke point every shell renders through means a new
shell cannot miss it". There were two choke points.

TestAssetTag_ReachesTheRenderedPage renders six real URLs through the production router and asserts
the buster is non-empty, 8 hex, and not a version. Red-proved by removing the call again: four
pages fail naming the empty value.

A PATCH VERSION, not a second push of 0.316.0 — the rule this release added, applied to its own
mistake rather than around it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y

controller/internal/web/server.go

@@ -1093,6 +1093,12 @@ func (s *Server) executeTemplate(w http.ResponseWriter, r *http.Request, name st
 	// fence for the guest share page, which has no admin session.
 	s.addEscrowBanner(data, r)
 	s.addMissedBackupBanner(data, r) // R-871 (decision 110)
+	// The stylesheet cache-buster, for the DASHBOARD shell. executeTemplateLang has called this for
+	// the stranger-facing pages since v0.255.0; this path did not need it while layout.html asked for
+	// `?v={{.Version}}`, which baseData supplies. v0.316.0 moved it to `{{.AssetTag}}` and the first
+	// live load rendered `?v=` — a constant, which is worse than the version it replaced. Both render
+	// paths now go through the one function, which is what v0.255.0's own comment asked for.
+	s.addShellAssetData(data)
 	lang := s.langFor(r)
 	s.addLanguageData(data, r, lang)
 	var buf bytes.Buffer