build: assert DEBUG is off in every emitted bundle as a post-build check (closes #170)

build.js records which emitted bundles contain src/shared/constants.js, and
constants.js carries a marker constant-folded from DEBUG itself. script/verify-build
cross-checks the two and fails on every way of not knowing, so deleting the
__BUILD_DEBUG__ define now breaks the build instead of shipping a live debug branch.

script/verify-build

@@ -0,0 +1,136 @@
+#!/bin/sh
+# script/verify-build: assert the compiled DEBUG state of the emitted
+# bundles. Our own extension to scripts-to-rule-them-all, run at the end of
+# make build / make build-debug.
+#
+# Why this exists: DEBUG makes the publicly committed test recovery phrase the
+# output of wallet creation, so a release artifact built with it live hands
+# every new wallet to anyone who reads the repo. The test suite cannot see
+# this, because it loads src/shared/constants.js outside a bundle and takes
+# the fallback branch; the property only exists in the emitted output, so it
+# has to be asserted against the emitted output.
+#
+# What it reads: dist/constants-bundles.txt, written by build.js from
+# esbuild's metafile, naming every emitted bundle that contains
+# src/shared/constants.js. Each of those must carry exactly one of the two
+# BUILD_DEBUG_MARKER literals that constants.js folds down to.
+#
+# It fails rather than passes whenever it cannot determine a bundle's state.
+# Minified output is not a stable contract, so "matched neither form" is not
+# evidence of anything and must never read as green.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+MANIFEST="dist/constants-bundles.txt"
+MARKER_ON="autistmask-build-debug=on"
+MARKER_OFF="autistmask-build-debug=off"
+
+# Set by read_marker.
+MARKER=""
+
+fail() {
+    echo "verify-build: FAIL: $*" >&2
+    exit 1
+}
+
+has_marker() {
+    grep -q -F "$1" "$2" 2>/dev/null
+}
+
+# Read one bundle's DEBUG state into MARKER. Exactly one marker must be
+# present. Both means the ternary in constants.js was never folded, which is
+# what happens when the __BUILD_DEBUG__ define goes missing from build.js:
+# DEBUG stops being known at build time and the debug branch is live again.
+# Neither means we are reading output we do not understand. Both are hard
+# failures; neither is ever treated as absence of a problem.
+read_marker() {
+    _file="$1"
+    _on=no
+    _off=no
+    if has_marker "$MARKER_ON" "$_file"; then _on=yes; fi
+    if has_marker "$MARKER_OFF" "$_file"; then _off=yes; fi
+
+    if [ "$_on" = yes ] && [ "$_off" = yes ]; then
+        fail "$_file carries both debug markers, so the build-time DEBUG value
+    was never resolved and the debug branch is still live. Check that build.js
+    still defines __BUILD_DEBUG__."
+    fi
+    if [ "$_on" = no ] && [ "$_off" = no ]; then
+        fail "$_file carries no debug marker, so its DEBUG state cannot be
+    determined. Either BUILD_DEBUG_MARKER is gone from src/shared/constants.js
+    or the emitted output changed shape. Refusing to report success."
+    fi
+
+    if [ "$_on" = yes ]; then
+        MARKER="$MARKER_ON"
+    else
+        MARKER="$MARKER_OFF"
+    fi
+}
+
+# The manifest says which bundles must carry a marker. This says no other
+# emitted bundle may carry one, which catches a manifest that has gone stale
+# or short rather than trusting whatever it happens to list.
+check_unlisted_bundles() {
+    _listing="$(find dist -type f -name '*.js' | sort)"
+    while read -r _file; do
+        [ -n "$_file" ] || continue
+        if grep -q -x -F "$_file" "$MANIFEST"; then
+            continue
+        fi
+        if has_marker "$MARKER_ON" "$_file" ||
+            has_marker "$MARKER_OFF" "$_file"; then
+            fail "$_file carries a debug marker but is absent from $MANIFEST,
+    so the manifest no longer describes the emitted bundles."
+        fi
+    done <<EOF
+$_listing
+EOF
+}
+
+# The requested mode, read from our own environment using build.js's exact
+# rule: only the literal 1 opts in. Deliberately not taken from anything
+# build.js records about itself, so build.js cannot vouch for build.js.
+expected_marker() {
+    if [ "${AUTISTMASK_DEBUG-}" = "1" ]; then
+        echo "$MARKER_ON"
+    else
+        echo "$MARKER_OFF"
+    fi
+}
+
+main() {
+    cd "$ROOT"
+
+    expected="$(expected_marker)"
+    echo "Verifying emitted bundles (expecting $expected)..."
+
+    [ -f "$MANIFEST" ] ||
+        fail "$MANIFEST is missing. build.js writes it at the end of a
+    successful build; run make build first."
+    [ -s "$MANIFEST" ] ||
+        fail "$MANIFEST is empty, so no emitted bundle was found to contain
+    src/shared/constants.js. That is never correct, so it is a failure and not
+    a pass."
+
+    count=0
+    while read -r file; do
+        [ -n "$file" ] || continue
+        [ -f "$file" ] ||
+            fail "$MANIFEST lists $file, which does not exist."
+        read_marker "$file"
+        [ "$MARKER" = "$expected" ] ||
+            fail "$file is $MARKER but this build expects $expected."
+        echo "  ok: $file ($MARKER)"
+        count=$((count + 1))
+    done <"$MANIFEST"
+
+    [ "$count" -gt 0 ] || fail "no bundles were inspected."
+
+    check_unlisted_bundles
+
+    echo "verify-build: $count bundle(s) verified $expected"
+}
+
+main "$@"