build: assert DEBUG is off in every emitted bundle as a post-build check (closes #170)

build.js records which emitted bundles contain src/shared/constants.js, and
constants.js carries a marker constant-folded from DEBUG itself. script/verify-build
cross-checks the two and fails on every way of not knowing, so deleting the
__BUILD_DEBUG__ define now breaks the build instead of shipping a live debug branch.

src/shared/constants.js

@@ -7,6 +7,21 @@
 /* global __BUILD_DEBUG__ */
 const DEBUG = typeof __BUILD_DEBUG__ !== "undefined" ? __BUILD_DEBUG__ : false;
 
+// Machine-readable record of the compiled DEBUG state, read out of the emitted
+// bundles by script/verify-build. It is derived from DEBUG itself so the two
+// cannot disagree, and it is a plain string literal rather than a minifier
+// artifact like `DEBUG:!1`, so the check does not depend on esbuild's output
+// staying byte-stable across versions.
+//
+// The ambiguity is the point. When DEBUG is known at build time the bundler
+// folds this to exactly one of the two literals. When it is not — which is
+// exactly what happens if the __BUILD_DEBUG__ define goes missing from
+// build.js — the ternary survives, both literals appear in the bundle, and
+// verify-build fails rather than guessing.
+const BUILD_DEBUG_MARKER = DEBUG
+    ? "autistmask-build-debug=on"
+    : "autistmask-build-debug=off";
+
 const DEBUG_MNEMONIC =
     "cube evolve unfold result inch risk jealous skill hotel bulb night wreck";
 
@@ -44,6 +59,7 @@ function isBurnAddress(address) {
 
 module.exports = {
     DEBUG,
+    BUILD_DEBUG_MARKER,
     DEBUG_MNEMONIC,
     ETHEREUM_MAINNET_CHAIN_ID,
     ETHEREUM_SEPOLIA_CHAIN_ID,