Fix SRI hash mismatch in export-and-sign

[leeland-turnkey]

The meta tag acts as a configuration value that the JavaScript reads at runtime from the DOM.

How it works:

1. Build time: Webpack builds the JS bundle. The SRI hash is computed on the bundle contents which now contains code that reads from a meta tag (not the placeholder string itself)
2. Deploy time: The init container templates index.html, replacing:
   <meta name="turnkey-signer-environment" content="__TURNKEY_SIGNER_ENVIRONMENT__" />
3. with:
   <meta name="turnkey-signer-environment" content="prod" />
4. Runtime: When the JS executes, it queries the DOM:
   const meta = document.querySelector('meta[name="turnkey-signer-environment"]');
environment = meta.content; // "prod"

Why this works:

• SRI hashes are only on <script> and tags to verify those external resources
• The HTML file itself isn't integrity-checked
• The JS bundle never changes after build, so its hash stays valid
• The JS gets the environment value by reading the DOM at runtime instead of having it embedded in the source

Current bug:

Rebuild in k8s: