You can't, unless the code that runs is entirely client side and interpreted directly from source, in which case they can verify it trivially with standard file comparison tools.
The reason is that you would have to prove that the entire software stack of the system was trustworthy, and that the entire hardware stack was trustworthy, and that every point on the network between your system and the client system was trustworthy. Oh, and that the client system was trustworthy.
Even with a third party system, you could potentially serve different files to that and to users - see this article about detecting the use of Bash pipes for an example of this. You could silently redirect the third party service to a "good" version of your code, whilst sending users the "bad" version, unless they are attempting to download the files for inspection, when you send the "good" version.
You could fake the third party system entirely, and actually control it yourself, claiming that every set of files was identical. You could intercept the response from a third party, changing it so that it appeared to show that all your code was safe. You could do that through malicious code which runs on the client system upon first load, so they never get a true response from the third party system, or just turn off the third party verification so they don't even know about it.
You can't even verify with complete confidence that a compiled application was generated from a specific set of source code, in the general case. See this answer from 2010 for some details on why - it's the same for any other compiled code, so don't be afraid of the VB6 references.
Basically, you have to behave in such a way that they trust that you won't do anything bad, and be prepared that some users won't have that level of trust. There are some people who won't use any software they haven't compiled themselves, on systems they built themselves, using hand written compilers, and even they might fall foul of malicious instructions buried in chips. We went past the point where it is possible to fully verify computer behavior a long time ago (read up on Ken Thompson's evil compiler for an example), and the client-server model doesn't help with that.
On the other hand, most of the time it doesn't matter - people trust systems all the time without this level of reassurance.