build: remove dist/ when a release build fails (closes #333)

A failed release build no longer leaves a complete, loadable debug bundle in dist/ whose every wallet uses the publicly committed test recovery phrase. Each step of the release build runs through script/discard-dist-on-failure, which removes dist/ on failure, says on stderr that it did and why, and returns the step's own status. build-debug is deliberately unwrapped. script/verify-build is untouched.

README.md

@@ -63,8 +63,12 @@ that runs `make build`, that target compiles a debug bundle and then **fails**,
 because it tells `script/verify-build` in so many words that it was supposed to
 produce a release build. It used to be that the verifier read the same variable
 out of its own environment, agreed with itself, and reported a debug artifact as
-verified. The build prints which mode it used. See the
-[DEBUG Mode Policy](#debug-mode-policy) for what the flag changes. **Never
+verified. The build prints which mode it used. A release build that fails also
+**removes `dist/`**, and says so: the bundle it had already written is loadable,
+and a loud failure is no protection against someone loading `dist/chrome/`
+anyway. `make build-debug` keeps its `dist/` on failure — that output is not
+mistakable for a release build, and it is the evidence of what went wrong. See
+the [DEBUG Mode Policy](#debug-mode-policy) for what the flag changes. **Never
 distribute a debug build** — every wallet it creates gets the same publicly
 known test recovery phrase.
 
@@ -158,16 +162,24 @@ provide:
   `make build` and `make build-debug`; fails loudly rather than passing whenever
   it cannot determine something. Not part of `make check`, which does not depend
   on build artifacts existing.
+- `script/discard-dist-on-failure COMMAND [ARG...]` — run one step of the
+  **release** build and, if it fails, remove `dist/` before returning that
+  step's exit status, saying on stderr that it did and why. Every step of
+  `make build` runs through it; `make build-debug` runs none of them through it.
+  A step that succeeds removes nothing, and a removal that cannot be completed
+  is reported as loudly as one that was
 - `script/test-verify-build` — exercise every failure mode of
   `script/verify-build` against a fixture tree in a temp dir, asserting the exit
-  status and the message of each, and read the `make build` and
+  status and the message of each, assert the state of `dist/` on disk after a
+  failing and a succeeding release build step, and read the `make build` and
   `make build-debug` recipes back out of `make -n` to check that they pass the
-  mode as an argument on a scrubbed environment. Part of `make check`; it reads
-  no build artifacts and writes nothing under `dist/`. The cases that depend on
-  file permissions cannot mean anything for a process that is not subject to
-  them, so the harness proves its runner against a mode-000 file before counting
-  them, dropping to an unprivileged user when run as root; if it cannot, it
-  skips those cases and says so in a banner rather than passing them.
+  mode as an argument on a scrubbed environment and wrap only the release path.
+  Part of `make check`; it reads no build artifacts and writes nothing under
+  `dist/`. The cases that depend on file permissions cannot mean anything for a
+  process that is not subject to them, so the harness proves its runner against
+  a mode-000 file before counting them, dropping to an unprivileged user when
+  run as root; if it cannot, it skips those cases and says so in a banner rather
+  than passing them.
 - `script/docker` — build the Docker image tagged via `script/projectname`
 - `script/cibuild` — CI entrypoint: plain `docker build .`
 - `script/precommit` — run by the git pre-commit hook; runs `script/check`
@@ -181,9 +193,11 @@ The Makefile shims to those. It also carries a few targets that have no
   silently rewritten. Use `make setup` for a fresh clone.
 - `make hooks` — shims to `script/install-precommit`
 - `make build` — build the extension into `dist/chrome/` and `dist/firefox/`,
-  then verify the result against the build's receipt as a release build
+  then verify the result against the build's receipt as a release build. A
+  failure at any step removes `dist/`
 - `make build-debug` — the same build with `AUTISTMASK_DEBUG=1`, verified as a
-  debug build (see [Debug Builds](#debug-builds))
+  debug build, and keeping its `dist/` on failure (see
+  [Debug Builds](#debug-builds))
 - `make clean` — remove `dist/`
 - `make dev` — build in watch mode