docs: state verify-build's dist/ guarantee at the width it enforces (closes #331)

check_dist_tree walks -type f -o -type l, so the emitted-tree cross-check covers
regular files and symlinks under dist/. README.md said "nothing under dist/ that
the build did not write", which is broader: fifos, sockets, device nodes and
empty directories are not checked.

The exclusion stays. A build emits none of those types, none can carry a
shippable payload, and grep on a fifo would hang rather than fail. README.md,
the script's header comment and the check_dist_tree comment now say so in the
same words, so the code and the docs cannot drift apart again.

Documentation only: no non-comment line of script/verify-build changed.

TODO.md

@@ -26,7 +26,8 @@ milestone is in flight on `next`; its `next` -> `main` PR is
 [#190](https://git.eeqj.de/sneak/AutistMask/pulls/190). `make check` verified
 green on `next` at `e9fa8be` on 2026-08-10, and `make build` produces
 `dist/chrome/` and `dist/firefox/`, verified against the build's own receipt to
-be exactly what that build emitted with `DEBUG` compiled off.
+hold exactly the regular files and symlinks that build emitted, with `DEBUG`
+compiled off.
 
 The backlog lives on the
 [Gitea tracker](https://git.eeqj.de/sneak/AutistMask/issues), which is
@@ -44,6 +45,16 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-08-23: `README.md` and `script/verify-build`'s own comments now state the
+  emitted-tree guarantee at the width the code actually enforces
+  ([#331](https://git.eeqj.de/sneak/AutistMask/issues/331)). The tree walk is
+  `-type f -o -type l`, so the guarantee covers regular files and symlinks under
+  `dist/`; fifos, sockets, device nodes and empty directories are not checked,
+  because a build emits none of them, none can carry a shippable payload, and
+  grep on a fifo would hang rather than fail. The exclusion is deliberate and
+  unchanged — the README said "nothing under `dist/` that the build did not
+  write", which was broader than that. Documentation only; no executable line
+  changed.
 - 2026-08-20: A second extension page can no longer silently delete a wallet
   ([#304](https://git.eeqj.de/sneak/AutistMask/issues/304)). `saveState()` wrote
   the entire state blob, and every extension page — the toolbar popup, a dApp