spec-4eh Add check-version and check-embedded-css targets to specs' Makefile Lined Up

What is wrong: specs' `Makefile` defines no `check-version:` or `check-embedded-css:` target, so its APKBUILD's `build()` runs only `make check-css` and `package()` re-verifies nothing.

Why it matters: `check-version` inspects the compiled binary (`go version -m $(CHECK_BIN)`) for `vcs.revision`/`vcs.modified` and fails the build if the tree was dirty; `check-embedded-css` greps the binary for the embedded stylesheet name and diffs it against what is on disk, catching "compiled before `make css` ran". Without these, a dirty/unstamped binary "links, starts and serves" and only ever misreports itself — the family has hit this class for real (a `GOTMPDIR` race in federation, a `go mod download all` incident in bench), and the sha256sum Makefile bug (tracked separately, D08) makes specs hit the CSS half of this on any non-GNU machine with nothing catching it.

Sibling that does it correctly: `sourcehut-bench`, `sourcehut-coverage`, `sourcehut-curator`, `sourcehut-tokens` (both targets) and `sourcehut-federation` (`check-version` only) all call these from both `build()` and `package()`, so the gate runs against the artefact that actually ships.

Fix: port `check-version`/`check-embedded-css` plus their `CHECK_BIN`/`CHECK_BINS` staged-artefact invocations from `sourcehut-tokens/Makefile` into specs' `Makefile`, and wire both into the APKBUILD's `build()` and `package()`. Templating work, not new design.

Note: confidence verified — `grep -n '^check-version:'` matches nothing in specs' Makefile.

Audit: D12 (cross-repo audit, 2026-08-17)