chore: draw the toolbar icons in-tree with make icons (closes #378)

script/lib/icons.js draws the mark from geometry read back out of the
committed PNGs, since the coordinates were never recorded, and writes each
PNG with node's own zlib; `make icons` runs it. tests/icons.test.js compares
what it draws with icons/ byte for byte.

That test is red on purpose. Every pixel matches at all four sizes, but
node 22's bundled zlib compresses at level 9 differently from the stock
zlib 1.3.1 that made the committed files, so the IDAT bytes differ. How to
settle that is the owner's call, asked on the issue. TODO.md is updated
with the landing commit.

build.js copies the manifests from MANIFEST_SOURCES instead of naming the
two paths a second time.

Model: opus-5-5

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug package vendor-blocklist clean dev
+.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug package vendor-blocklist icons clean dev
 
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -104,6 +104,12 @@ build-debug:
 vendor-blocklist:
 	@script/vendor-blocklist
 
+# Redraw the toolbar icons in icons/ from script/lib/icons.js, at every size
+# manifest/chrome.json declares. Commit the result with the drawing:
+# tests/icons.test.js fails while the two disagree.
+icons:
+	@node script/lib/icons.js
+
 clean:
 	@rm -rf dist/ release/