chore: bring the token-list enrichment tooling into script/lib (closes #495)

The two node programs and the data file from f7a2437 regenerate the name and
url of each token in src/shared/tokenList.js. They are now CommonJS under
script/lib/, find their files from their own location, and read
ethereum-lists at a pinned commit. The apply step also rewrites an entry that
already has a name and url, so it runs on the current list; on the committed
data it leaves the list unchanged. The data file carries the MUSD token's
on-chain name, so script/check-censored allows that one literal there too.
README.md names both programs in its Entrypoints section.

Model: opus-5-5

README.md

@@ -246,11 +246,13 @@ provide:
   nowhere in the working tree or under `dist/` outside its documented
   exceptions: the pinned source reference in `script/vendor-blocklist`, the two
   provider-shim identifiers in `src/content/inpage.js`, and one ERC-20's
-  on-chain name in `src/shared/tokenList.js`. Each is scoped to that path and
-  fails anywhere else. Run by the `lint` phase, so part of `make check`; it
-  inspects `dist/` when there is one and says loudly when there is not, and the
-  build context of that phase never has one. `make build` re-runs it with
-  `--require-dist`, so a build artifact is always covered
+  on-chain name in `src/shared/tokenList.js` and in
+  `script/lib/token-enrichment.json`, the fetched data that file's names are
+  written from. Each is scoped to the paths named and fails anywhere else. Run
+  by the `lint` phase, so part of `make check`; it inspects `dist/` when there
+  is one and says loudly when there is not, and the build context of that phase
+  never has one. `make build` re-runs it with `--require-dist`, so a build
+  artifact is always covered
 - `script/package` — produce the release artifacts: `make build` first, so the
   archives can only ever be made from a `dist/` that has been verified against
   that build's own receipt as a RELEASE build, then one self-contained,
@@ -333,6 +335,19 @@ The Makefile shims to those. It also carries a few targets that have no
   change anywhere else, `package.json` and `build.js` included, starts no build,
   and a directory created while it runs is not watched; restart it after either
 
+Two node programs regenerate the `name` and `url` of each token in
+`src/shared/tokenList.js`. They are run by hand, never by a build or by
+`make check`, and they do not change which tokens are on the list:
+
+- `node script/lib/enrich-tokens.js` — fetch each token's name from CoinGecko's
+  coin list and its website from the `ethereum-lists/tokens` repository, at a
+  pinned commit, into `script/lib/token-enrichment.json`. CoinGecko's list is
+  live and has no fixed version, so a later run can return different names
+- `node script/lib/apply-enrichment.js` — write the names and URLs in
+  `script/lib/token-enrichment.json` into `src/shared/tokenList.js`, taking a
+  URL from the table of project websites in the script where the fetched data
+  has none
+
 ## End-to-End Tests
 
 There are two suites, one per browser, and they share no code. Chrome runs on
@@ -2762,7 +2777,7 @@ exact URL, the commit it is pinned to and the sha256 of the bytes that commit
 serves, because a source reference nobody can verify is not a source reference.
 `script/check-censored` reads the name back out of that one file and fails the
 build wherever else it appears, save for three shipped-code literals it cannot
-avoid — each permitted only at the one path that carries it, and listed in that
+avoid — each permitted only at the paths that carry it, and listed in that
 script's header.
 
 ## Author