> Fundamentally: There is no way to lock webapps to reproducible builds.

One could absolutely use subresource integrity to lock one’s reference to a vendor’s subresource to a specific version. That’s what it’s there for.

That's only meaningful if you are loading resources from a separate domain (e.g., a CDN or another subdomain).

There is no way to, for instance, only allow updates to a PWA from files signed by an offline key.

This only defers the issue to trusting that index.html is always trusted.