feat(dart): tell a web build, and Sentry, which build it is

[nikzen]

A web build cannot say which build it is, so a bug report names a day rather than a revision and a browser's stack trace arrives minified. famedly/call solves both by generating a Dart file into its own source tree on every CI run.
Two options replace that.

• web.version.enable passes git describe and the commit as the version and commit dart-defines, read with String.fromEnvironment, so the file call used to check in keeps its debug defaults and stops being overwritten.
• web.sentry.enable asks the compiler for the source maps and hands them to Sentry under that release and distribution. Turns the version on by itself: a symbol file is only found again by the release it was filed under.

Both are command substitutions in the build command rather than a step that exports them, so the command the flake prints still reproduces a CI build by hand. Deepening the checkout is now steps.withHistory, which the commit
message check also uses.

The maps go to Sentry and no further. They land in build/web, which is the artefact Pages, the review apps and the images all serve, so a later step deletes them again — including on the runs that skip the upload, which built
them all the same. Those are merge queues, whose builds nobody sees, and Dependabot, which has no access to our secrets and would otherwise fail on an empty token and take the build down with it. The review app already steps
around it the same way.

Not carried over from call: the cache-busting sed on index.html, which has matched nothing since the framework started loading the bundle from flutter_bootstrap.js, and the 16-core runner, since the Rust bindings that
made the job long are a cached package now.

Stacked on #62; the build.nix it extends comes from #56.

Test plan

• nix flake check --all-systems, prek --all-files --stage pre-push
• the generated workflow checks out deep, carries both defines, uploads after the build and skips it in a merge queue and for Dependabot
• built famedly/call with the generated command: v1.0.12-17-g039c1d2 and the full sha are in main.dart.js, and the map is there to upload
• the deletion matches *.js.map and *.wasm.map and leaves other assets alone, checked against a tree holding a file named world.map
• the upload itself needs a token and a release, so it is unverified until the migration runs it

Made with Cursor

---

The stack

main ─┬─ #63  make room on the runner
      ├─ #59  substitute from the shared binary cache
      └─ #56  sign, describe and scan what we publish
            └─ #62  keep the build directory out of vodozemac
                  └─ #61  tell a web build which build it is  ←
                        └─ #64  let a project choose its vodozemac

#63 and #59 stand outside the chain and can land in any order. #59 and #56
both touch the vodozemac module, so whichever goes second wants a rebase.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit fe72370. Configure here.}