chore: draw the toolbar icons in-tree with make icons (closes #378)

script/lib/icons.js draws the mark from geometry read back out of the
committed PNGs, since the coordinates were never recorded, and writes each
PNG with node's own zlib; `make icons` runs it. tests/icons.test.js compares
what it draws with icons/ byte for byte.

That test is red on purpose. Every pixel matches at all four sizes, but
node 22's bundled zlib compresses at level 9 differently from the stock
zlib 1.3.1 that made the committed files, so the IDAT bytes differ. How to
settle that is the owner's call, asked on the issue. TODO.md is updated
with the landing commit.

build.js copies the manifests from MANIFEST_SOURCES instead of naming the
two paths a second time.

Model: opus-5-5

README.md

@@ -317,6 +317,10 @@ The Makefile shims to those. It also carries a few targets that have no
 - `make build-debug` — the same build with `AUTISTMASK_DEBUG=1`, verified as a
   debug build, and keeping its `dist/` on failure (see
   [Debug Builds](#debug-builds))
+- `make icons` — redraw the toolbar icons in `icons/` from
+  `script/lib/icons.js`, at every size `manifest/chrome.json` declares. Commit
+  the files with the drawing: `make check` fails while they differ from what it
+  draws
 - `make clean` — remove `dist/` and `release/`
 - `make dev` — run the build `make build` runs, without the checks that follow
   it, then run it again after every change to a file under `src/`, `manifest/`