chore(ci): verify the assets entrypoints.json actually points at

[Björn Meyer (BrocksiNet)]

What

Closes a hole in bin/ci-assert-zip-admin-bundle.sh: it never checked that the assets
entrypoints.json points at are actually in the archive.

Not urgent — the current release artifact is fine, verified by hand. This just makes the
guard cover the last way the original bug's failure mode could recur.

Why

The guard was written against a build that emitted only unhashed filenames. The release
build emits content-hashed assets with an unhashed alias beside them:

administration/js/swag-agentic-commerce-PMJ7ZT4L.js   <- entrypoints.json points here
administration/js/swag-agentic-commerce.js            <- unhashed alias
administration/.vite/entrypoints.json

Those feed two different consumers:

Lane	Resolves	Reads entrypoints.json?
6.5 / 6.6	administration/js/{technicalName}.js by convention	no
6.7	whatever entryPoints[...].js names	yes

The guard checked the unhashed path is a real bundle, and separately that the js list is
non-empty — but never that the named file exists. An archive whose hashed target was
missing or misnamed passed the guard and then 404'd on 6.7, silently, in exactly the way
the bug this guard exists to catch was silent.

How

• Resolve every asset (js + css) referenced by entrypoints.json and assert each ships.
• Assert the js entry 6.7 actually executes is the compiled bundle, not just the alias.
• Keep the existing unhashed-path checks for 6.5/6.6.

Output now names both paths so a CI log says which lane loads what:

OK: 6.5/6.6 load js/swag-agentic-commerce.js (97198 bytes);
    6.7 loads /bundles/swagagenticcommerce/administration/js/swag-agentic-commerce-PMJ7ZT4L.js (97198 bytes);
    all 2 referenced assets ship.

Deliberately not asserting the hashed and unhashed copies are byte-identical. They are
today (1346ca66… for both js and css), but shopware-cli is free to emit the alias
differently and the "is this the real bundle" checks already catch the failures that matter.

Testing

Run against four real archives plus one synthesised:

Archive	Result
Release artifact from run 31175934692 (hashed + unhashed)	pass
Local esbuild build (unhashed only)	pass
The shipped-broken 1.2.0 zip	fail — 2382-byte shim
Vite-only zip	fail — 2382-byte shim
Release artifact with the hashed target deleted, alias intact	fail (new) — old guard reported OK

That last row is the point of the change. shellcheck -x bin/*.sh bin/lib/*.sh is clean,
matching the shell-lint job.