build: remove dist/ when a release build fails (closes #333)

With AUTISTMASK_DEBUG=1 exported in the calling shell, make build compiled a
debug bundle and failed on it in script/verify-build, but left the bundle in
dist/: loadable, with every wallet it creates using the publicly committed test
recovery phrase from src/shared/constants.js. A failed release build that leaves
a loadable debug build behind is the trap the verifier exists to close.

Every step of make build now runs through script/discard-dist-on-failure, which
removes dist/ when its step fails and says on stderr that it did and why, then
returns the step's own exit status. A removal it cannot complete is reported as
loudly as one it can, naming what is still on disk. A step that succeeds removes
nothing, including the final check-censored --require-dist pass. It composes
with the existing receipt trap: the receipt is still deleted on the way out.

make build-debug is deliberately not wrapped. A debug build that failed is not
producing an artifact mistakable for a release one, and its dist/ is the
evidence of what went wrong.

script/test-verify-build asserts the state of dist/ on disk after a failing and
a succeeding step rather than the exit status alone, plus a step that fails with
no dist/ and a wrapper handed no command, and reads make -n to check the wrapper
is on the release path and absent from the debug one. Both directions were also
run end to end: AUTISTMASK_DEBUG=1 make build fails and leaves no dist/, plain
make build passes with all 15 emitted files intact, and a debug build failed
mid-write keeps its dist/.

verify-build itself is unchanged; this is only what happens after it says no.

TODO.md

@@ -45,6 +45,19 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-08-23: A failed release build no longer leaves a loadable debug bundle in
+  `dist/` ([#333](https://git.eeqj.de/sneak/AutistMask/issues/333)). With
+  `AUTISTMASK_DEBUG=1` exported, `make build` compiled a debug bundle and failed
+  on it in `script/verify-build` — but the bundle stayed on disk, loadable, with
+  every wallet it creates using the publicly committed test recovery phrase.
+  Every step of `make build` now runs through `script/discard-dist-on-failure`,
+  which removes `dist/` when a step fails and says on stderr that it did and
+  why; a removal it cannot complete is reported just as loudly.
+  `make build-debug` is deliberately not wrapped: its output is not mistakable
+  for a release build and is the evidence of the failure.
+  `script/test-verify-build` asserts the state of `dist/` on disk after a
+  failing and a succeeding step, not just the exit status, and reads `make -n`
+  to check the wrapper is on the release path and only there.
 - 2026-08-23: `README.md` and `script/verify-build`'s own comments now state the
   emitted-tree guarantee at the width the code actually enforces
   ([#331](https://git.eeqj.de/sneak/AutistMask/issues/331)). The tree walk is