Option2 무결성 강화: integrity index 추가, 인덱스 정렬/교차 검증, referencedAt 매트릭스, README 문서화 (TDD)

README.md

@@ -44,6 +44,7 @@ The Builder can export a production-ready ZIP that contains:
 - site.webmanifest, robots.txt
 - Optional: sheets/ (Google Apps Script template)
 - Metadata files: assets.json, assets.index.json
+  - Integrity: assets.integrity.index.json
 
 ### Export Options UI
 
@@ -94,6 +95,17 @@ Simple index to quickly find assets by group:
 - fonts: string[] of zip paths
 - other: string[] of zip paths
 
+### assets.integrity.index.json
+
+- entries: array of `{ path, integrity }`
+  - `path`: asset `zipPath` (e.g. `assets/abcd1234.png` or grouped `assets/images/...`)
+  - `integrity`: `sha256-<base64>` (real SHA-256 of the asset bytes)
+- bundleHash: `sha256-<base64>` over a deterministic join of `path` and `integrity` for all entries
+
+Usage:
+- Verify file-level integrity by recomputing SHA-256(base64) of each asset and comparing with `entries[].integrity`.
+- Verify bundle integrity by recomputing `bundleHash` from sorted entries; useful for quick tamper detection.
+
 ### Google Sheets template (optional)
 
 - When included, ZIP contains: