Fix missing production stylesheet

[ChelseaKR]

Summary

• package app.css inside wheel/container installs
• resolve static assets from the installed package with a source-checkout fallback
• add unit and release-artifact regression gates

Production symptom

https://ledger.chelseakr.com/static/app.css returned 404, leaving pages rendered with browser defaults.

Verification

• make verify (982 tests)
• built wheel contains ledger/static/app.css
• targeted server/security suite: 21 passed

Deployment

After merge, replace the Terraform-managed instance and verify the CSS returns 200 text/css before closing.

[ChelseaKR]

Production verification completed for merged commit db5cab8.\n\n- Deployed instance: i-00e8c6ad2a0318863\n- https://ledger.chelseakr.com/static/app.css returns 200 with text/css; charset=utf-8\n- Production and repository stylesheet SHA-256 hashes match\n- Cache-Control and ETag are present; conditional request returns 304\n- All smoke-tested routes return 200\n- EC2 checks are ok/ok\n- Terraform detailed exit code is 0 (no drift)\n- Console audit remains at zero secret-assignment traces\n- Browser screenshot confirms the stylesheet is applied