docs: publish Preview 19 dogfood evidence

Export the reviewed allowlisted snapshot from private source commit 05928cebd01b586cf9e9d4b8c8537a7605a6068c. This records the exact candidate, bounded capacity result, stateful migration scratch requirement, authenticated batch identity proof, and immediate live acceptance evidence.

AI-Assisted: OpenAI Codex
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

internal/site/assets.go

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+// Package site contains Observatory's typed Sandwich Hime interface and its
+// immutable browser assets. HTTP policy remains owned by internal/httpserver.
+package site
+
+import (
+	"crypto/sha256"
+	_ "embed"
+	"encoding/hex"
+)
+
+//go:embed assets/site.css
+var style []byte
+
+//go:embed assets/site.js
+var script []byte
+
+//go:embed assets/observatory.svg
+var icon []byte
+
+type Assets struct {
+	StylePath  string
+	ScriptPath string
+	IconPath   string
+}
+
+func AssetPaths() Assets {
+	return Assets{StylePath: fingerprintedPath("site", "css", style), ScriptPath: fingerprintedPath("site", "js", script), IconPath: fingerprintedPath("observatory", "svg", icon)}
+}
+
+func Asset(path string) (body []byte, contentType string, ok bool) {
+	assets := AssetPaths()
+	switch path {
+	case assets.StylePath:
+		return style, "text/css; charset=utf-8", true
+	case assets.ScriptPath:
+		return script, "text/javascript; charset=utf-8", true
+	case assets.IconPath:
+		return icon, "image/svg+xml", true
+	default:
+		return nil, "", false
+	}
+}
+
+func fingerprintedPath(name, extension string, body []byte) string {
+	digest := sha256.Sum256(body)
+	return "/assets/" + name + "-" + hex.EncodeToString(digest[:8]) + "." + extension
+}