build: assert DEBUG is off in every emitted bundle as a post-build check (closes #170)

build.js records which emitted bundles contain src/shared/constants.js, and
constants.js carries a marker constant-folded from DEBUG itself. script/verify-build
cross-checks the two and fails on every way of not knowing, so deleting the
__BUILD_DEBUG__ define now breaks the build instead of shipping a live debug branch.

TODO.md

@@ -32,6 +32,9 @@ review.
   longer crosses the extension messaging boundary; the background broadcasts and
   resolves approvals only, and verifies the signed artifact against the approval
   it holds (#157).
+- 2026-08-09: Post-build assertion that every emitted bundle containing
+  `constants.js` has `DEBUG` compiled off, via `script/verify-build` on the
+  `make build` path (#170).
 - 2026-08-09: Containerized Chrome end-to-end harness (`make test-e2e` /
   `script/test-e2e`) driving the real popup with all network intercepted, plus
   the two used-but-not-imported crashes it caught: AddToken unreachable (#150)