ci(observability): verify CSS mirror instead of mutating runner

scripts/sync_observability_css.py

@@ -13,6 +13,7 @@ This helper keeps the two files byte-identical so deploys do not regress into
 
 from __future__ import annotations
 
+import argparse
 import shutil
 from pathlib import Path
 
@@ -23,20 +24,38 @@ TARGET = ROOT / "web/static/css/observability-system.css"
 
 
 def main() -> int:
+    parser = argparse.ArgumentParser(description="Sync or check observability CSS mirror")
+    parser.add_argument(
+        "--check",
+        action="store_true",
+        help="Only verify source and Flask static mirror are byte-identical.",
+    )
+    args = parser.parse_args()
+
     if not SOURCE.exists():
         print(f"ERROR: missing source CSS: {SOURCE.relative_to(ROOT)}")
         return 1
 
-    TARGET.parent.mkdir(parents=True, exist_ok=True)
+    if not args.check:
+        TARGET.parent.mkdir(parents=True, exist_ok=True)
+
     source_bytes = SOURCE.read_bytes()
     target_bytes = TARGET.read_bytes() if TARGET.exists() else b""
 
     if source_bytes == target_bytes:
-        print("Observability CSS sync: already in sync")
+        action = "check" if args.check else "sync"
+        print(f"Observability CSS {action}: already in sync")
         print(f"- source: {SOURCE.relative_to(ROOT)}")
         print(f"- target: {TARGET.relative_to(ROOT)}")
         return 0
 
+    if args.check:
+        print("Observability CSS check: FAIL")
+        print(f"- source: {SOURCE.relative_to(ROOT)}")
+        print(f"- target: {TARGET.relative_to(ROOT)}")
+        print("- fix: python3 scripts/sync_observability_css.py")
+        return 1
+
     shutil.copyfile(SOURCE, TARGET)
     print("Observability CSS sync: synced")
     print(f"- source: {SOURCE.relative_to(ROOT)}")