fix: make dev rebuilds dist/ on source changes (closes #332)

make dev passed --watch to a build.js that read no arguments, so it
built once and exited. build.js --watch now builds, then builds again
after every change to a file under src/, manifest/ or icons/, until
interrupted; any other argument fails. Each directory gets its own
watcher, because Node's recursive watch on Linux loses a file that an
editor saves by renaming a new copy over it. A watch build writes no
build receipt and cannot be verified; README.md and the Makefile say
so and point to make build.

Model: opus-5-5

TODO.md

@@ -45,6 +45,17 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-10-05: `make dev` watches
+  ([#332](https://git.eeqj.de/sneak/AutistMask/issues/332)). It used to pass
+  `--watch` to a `build.js` that read no arguments, so it built once and exited.
+  `build.js --watch` now builds, then builds again after every change to a file
+  under `src/`, `manifest/` or `icons/`; any other argument fails. It watches
+  each directory rather than using Node's recursive watch, which on Linux stops
+  seeing a file an editor saves by renaming a new copy over it. It writes no
+  build receipt, so nothing can verify what it builds; `make build` remains the
+  way to produce a `dist/` to hand on. `tests/buildWatch.test.js` covers the
+  watch loop against a temp directory.
+
 - 2026-10-05: `PROXY_METHODS` in `src/background/index.js` no longer lists
   `eth_chainId` and `net_version`
   ([#326](https://git.eeqj.de/sneak/AutistMask/issues/326)). `handleRpc` answers