feat(sw): stamp CACHE_NAME with git hash on Release publish

Source carries a hand-bumped 'ona-plotter-vNNN' literal that has
to be incremented for every shell-asset change or the browser
keeps serving the previous version's cache. A new
StampPublishedServiceWorker MSBuild target rewrites the published
copy of service-worker.js with the commit hash already computed
by StampBuildInfo, so every build is automatically cache-unique
and the source line just stays as a sane default.

The stamp script anchors its regex on the CACHE_NAME assignment
so TILE_CACHE_NAME (different lifecycle) isn't touched. Source
file is untouched; only the publish output changes.

Author: msallin

OnaPlotter/OnaPlotter.csproj

@@ -188,4 +188,28 @@
           Condition="'@(_JsToMinify)' != ''" />
   </Target>
 
+  <!-- Stamp the published service-worker.js CACHE_NAME with the git
+       hash so a new build invalidates the browser's installed SW
+       cache. Source carries a hand-bumped placeholder
+       (const CACHE_NAME = 'ona-plotter-vNNN'); this target rewrites
+       it in the publish output only, leaving the source clean. Runs
+       after MinifyPublishedJs so the stamped name lives in the
+       version the helm actually downloads.
+
+       OnaGitHash is computed by the StampBuildInfo target earlier
+       in the build; on git-less environments it falls back to
+       "unknown", in which case every cacheless deploy lands on the
+       same key. That's a deliberate trade-off vs failing the build
+       in environments that have no .git directory (tarball builds,
+       certain CI containers). -->
+  <Target Name="StampPublishedServiceWorker"
+          AfterTargets="MinifyPublishedJs"
+          Condition="'$(Configuration)' == 'Release'">
+    <PropertyGroup>
+      <_SwPath>$(PublishDir)wwwroot\service-worker.js</_SwPath>
+    </PropertyGroup>
+    <Exec Command="node &quot;$(MSBuildThisFileDirectory)..\scripts\stamp-cache-name.mjs&quot; &quot;$(_SwPath)&quot; &quot;$(OnaGitHash)&quot;"
+          Condition="Exists('$(_SwPath)')" />
+  </Target>
+
 </Project>

scripts/stamp-cache-name.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+//
+// Stamps the service worker's CACHE_NAME with a deploy-unique identifier
+// so a new build invalidates the browser's installed cache. Without this,
+// the SW reuses the cache keyed by the hand-bumped 'ona-plotter-vNNN'
+// literal, and stale .wasm / .js / .css get served from cache until the
+// helm hard-refreshes.
+//
+// Invoked from OnaPlotter.csproj's StampPublishedServiceWorker target on
+// Release publish. Two args:
+//
+//   node stamp-cache-name.mjs <path-to-service-worker.js> <git-hash>
+//
+// Patches in place. Idempotent: matches /ona-plotter-[\w-]+/ at the
+// CACHE_NAME assignment line so re-running with a different hash works.
+// Fails non-zero (and explains) if no match is found - a future rename
+// of CACHE_NAME would otherwise silently skip the stamp and let stale
+// caches leak through.
+//
+
+import { readFileSync, writeFileSync } from 'node:fs';
+
+const [, , swPath, hash] = process.argv;
+if (!swPath || !hash) {
+    console.error('usage: stamp-cache-name.mjs <path> <hash>');
+    process.exit(2);
+}
+
+const src = readFileSync(swPath, 'utf8');
+
+// Anchor the regex on the CACHE_NAME assignment to avoid catching the
+// TILE_CACHE_NAME (which has its own lifecycle) or any incidental
+// "ona-plotter-..." substring elsewhere in the file.
+const pattern = /(const CACHE_NAME = ')ona-plotter-[\w-]+(')/;
+if (!pattern.test(src)) {
+    console.error(
+        `stamp-cache-name: no 'const CACHE_NAME = "ona-plotter-..."' line ` +
+        `found in ${swPath}. Did the assignment shape change?`,
+    );
+    process.exit(1);
+}
+
+const patched = src.replace(pattern, `$1ona-plotter-${hash}$2`);
+writeFileSync(swPath, patched);
+console.log(`stamp-cache-name: CACHE_NAME = ona-plotter-${hash} in ${swPath}`);