Our contract states they cannot change code without my permission.

This won't help with the scripts that you're currently locked out of, but in the future, build in a command to return (e.g., as "text/plain") a set of MD5 hashes, one for each of your components. To prevent your customers from simply replacing that command with a hard-coded print of the "correct" hashes, pass a parameter to the command, use the parameter to generate a new hash. E.g.,

    my $nonce = param('nonce');
    ...
    my $md5_script = md5_hex($script_body);
    my $md5 = md5_hex($md5_script . $nonce);
    print "$script: $md5\n";
[download]

Then, assuming you have an identical copy of the source on hand, pick a random number, calculate the hash values for your copy of the surce files, then pass that random value to the remove CGI, comparing the values that it returns.