SW: mutable no-cache files bypass the SW cache (Codex audit) + beacon build id

Codex's finding: cache-as-you-go would pin files Caddy deliberately serves
no-cache (version.json, manifest, word lists, icons) in the SW cache until the
next SW version — silently defeating the revalidate policy for controlled
clients. version.json is the critical one (it's how the app detects a fresh
deploy); stale word lists could drift from the server's validated answer pool.
New isMutablePath() exclusion: the SW steps aside and the browser HTTP cache
revalidates these per their headers.

Telemetry polish (also Codex): the boot beacon now fills the app_version
column with the entry chunk's hashed filename scraped from the shell's own
modulepreload link (no extra fetch) — deploy-correlated load errors become
obvious. Admin list returns + shows it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_admin.py

@@ -412,12 +412,14 @@ def test_word_pool_admin(tmp_path, monkeypatch):
 def test_client_error_telemetry(tmp_path, monkeypatch):
     app, api = _make(tmp_path, monkeypatch, admin_email="boss@x.com")
     anon = TestClient(app)
-    assert anon.post("/api/client-error", json={"reason": "boot-timeout", "path": "/play"}).json()["ok"] is True
+    assert anon.post("/api/client-error",
+                     json={"reason": "boot-timeout", "path": "/play", "version": "start.Bzfu1yPF.js"}).json()["ok"] is True
     assert anon.get("/api/admin/client-errors").status_code == 401  # gated
     tc = _signin(app, api, "boss@x.com")
     rows = tc.get("/api/admin/client-errors").json()
     assert len(rows) == 1 and rows[0]["reason"] == "boot-timeout" and rows[0]["path"] == "/play"
     assert rows[0]["user_agent"]  # captured from the request header
+    assert rows[0]["app_version"] == "start.Bzfu1yPF.js"  # build correlation for deploy-related errors
     assert rows[0]["bot"] is False
     assert tc.get("/api/admin/stats").json()["client_errors"]["today"] == 1
     # A throttled crawler tripping the beacon must NOT inflate the headline count,