build: make verify-build take an explicit expectation and a build receipt (closes #309)

verify-build read its expectation from AUTISTMASK_DEBUG in its own environment
and the Makefile invoked it bare, so an operator with that variable exported
who ran the release target got an INSECURE debug build — every wallet it
creates uses the publicly committed test phrase — verified green, exit 0. It
also had no provenance: a 26-byte file containing the right marker string
passed, the content script and manifest.json were never inspected, and an
entire hand-written dist/ passed.

--expect release|debug and --receipt PATH are now both required, with no
defaults and nothing read from the environment. build.js records every file it
emits with its sha256 and writes the receipt; the Makefile mktemps it outside
the repo per invocation with a trap, and build.js refuses a receipt path inside
dist/. Verification runs three passes in a load-bearing order — receipt shape,
full dist/ walk, then per-file bytes — so an unwalkable subtree cannot make
files look absent. dist/constants-bundles.txt, which was an unsigned trust root
living inside the tree it vouched for, is gone.

What this proves is bounded and stated as such: dist/ is byte-for-byte the
output of the build.js run that just finished, within one make build
invocation. It proves nothing about the honesty of the source tree or build.js,
and nothing to anyone handed a dist/ from elsewhere — that is signing, #310.
The standalone make verify-build target is removed because its only input would
be dist/ itself, i.e. the artifact vouching for itself.

Verified: make check green, test-verify-build 39 cases (was 18), test-e2e 55/55
and test-e2e-firefox 8/8 with make build running uncached inside both images.
All four original bypasses now exit 1. Mutations: digests disabled fails
exactly 4 cases, dropping the dist/ walk fails exactly 8, restoring the ambient
fallback fails exactly 1.

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug verify-build vendor-blocklist clean dev
+.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug vendor-blocklist clean dev
 
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -47,10 +47,27 @@ docker:
 hooks:
 	@script/install-precommit
 
+# build.js writes a receipt of everything it emitted — every path, its sha256,
+# and whether it is a bundle containing constants.js — and script/verify-build
+# checks dist/ against that. The receipt is made here, fresh per invocation,
+# outside the repo, and deleted again: a standing file inside dist/ would be
+# rewritten by whoever rewrote dist/, which is what made the old check
+# satisfiable by a hand-written tree.
+#
+# The expected mode is an explicit argument and AUTISTMASK_DEBUG is scrubbed
+# from the verifier's environment. The script no longer reads it at all; env -u
+# is here so that stays true of anything it calls. It is deliberately NOT
+# scrubbed from the build itself: with AUTISTMASK_DEBUG=1 exported, this target
+# compiles a debug bundle and then fails on it, loudly, rather than quietly
+# handing back something other than the release build that was asked for.
 build:
 	@echo "Building extension..."
-	@yarn run build 2>&1
-	@script/verify-build
+	@set -eu; \
+	receipt="$$(mktemp "$${TMPDIR:-/tmp}/autistmask-build-receipt.XXXXXX")"; \
+	trap 'rm -f "$$receipt"' EXIT INT TERM; \
+	AUTISTMASK_BUILD_RECEIPT="$$receipt" yarn run build 2>&1; \
+	env -u AUTISTMASK_DEBUG script/verify-build --expect release \
+		--receipt "$$receipt"
 	@script/check-censored --require-dist
 
 # Development-only build: enables the red DEBUG / INSECURE banner and makes
@@ -58,15 +75,14 @@ build:
 # distribute the artifacts this produces.
 build-debug:
 	@echo "Building extension (DEBUG)..."
-	@AUTISTMASK_DEBUG=1 yarn run build 2>&1
-	@AUTISTMASK_DEBUG=1 script/verify-build
+	@set -eu; \
+	receipt="$$(mktemp "$${TMPDIR:-/tmp}/autistmask-build-receipt.XXXXXX")"; \
+	trap 'rm -f "$$receipt"' EXIT INT TERM; \
+	AUTISTMASK_DEBUG=1 AUTISTMASK_BUILD_RECEIPT="$$receipt" yarn run build 2>&1; \
+	env -u AUTISTMASK_DEBUG script/verify-build --expect debug \
+		--receipt "$$receipt"
 	@script/check-censored --require-dist
 
-# Assert the compiled DEBUG state of the bundles already in dist/. Runs at
-# the end of build and build-debug; separate target for re-running it alone.
-verify-build:
-	@script/verify-build
-
 # Refresh src/shared/phishingBlocklist.json from its hash-pinned upstream.
 # Run deliberately, land the diff: the extension does no runtime fetching, so
 # the shipped list is as fresh as the last vendoring run that was released.