fix(web): SPA build version doesn't sync on release — extra-files marker never matches

[mforce]

Bug

#459 added web/.env.production (VITE_APP_VERSION) with a release-please-config.json extra-files entry to keep it in lockstep with version.txt on every release PR. On the first real release (#461, v0.0.4), it didn't fire — version.txt bumped to 0.0.4 but web/.env.production stayed at 0.0.3. Caught by Codex review on #461: #461 (comment)

Root cause

Release-please's generic file updater only matches a semver pattern on the same line as the x-release-please-version marker comment — not the line below it. #459 placed the marker on the line above the value:

# x-release-please-version
VITE_APP_VERSION=0.0.3

The marker's own line has no semver pattern on it, so the updater silently finds nothing to replace and leaves the file untouched. No error, no warning — just a no-op.

#459 avoided a trailing same-line marker because it assumed dotenv-style .env parsing doesn't strip inline # comments. That assumption is backwards: dotenv (which Vite's env loading is built on) strips inline # comments on unquoted values by default since v15+ — VITE_APP_VERSION=0.0.3 # x-release-please-version loads as a clean 0.0.3 at runtime, comment stripped.

Fix

Move the marker to a trailing same-line comment so release-please's generic updater actually has a semver pattern to match on the marker's line, and verify dotenv strips it correctly in the built bundle.

Follows #459.

[mforce]

Consolidating into #458 (reopened) rather than tracking as a separate issue — same feature, root cause below.