chore: draw the toolbar icons in-tree with make icons (closes #378)

script/lib/icons.js draws the mark from geometry read back out of the
committed PNGs, since the coordinates were never recorded, and writes each
PNG with node's own zlib; `make icons` runs it. tests/icons.test.js compares
what it draws with icons/ byte for byte.

That test is red on purpose. Every pixel matches at all four sizes, but
node 22's bundled zlib compresses at level 9 differently from the stock
zlib 1.3.1 that made the committed files, so the IDAT bytes differ. How to
settle that is the owner's call, asked on the issue. TODO.md is updated
with the landing commit.

build.js copies the manifests from MANIFEST_SOURCES instead of naming the
two paths a second time.

Model: opus-5-5

build.js

@@ -588,15 +588,10 @@ async function build() {
         copyIcons(distDir);
     }
 
-    // copy manifests
-    copyEmitted(
-        path.join(__dirname, "manifest", "chrome.json"),
-        path.join(DIST_CHROME, "manifest.json"),
-    );
-    copyEmitted(
-        path.join(__dirname, "manifest", "firefox.json"),
-        path.join(DIST_FIREFOX, "manifest.json"),
-    );
+    // copy manifests, the same files copyIcons() read
+    for (const [distDir, manifestPath] of MANIFEST_SOURCES) {
+        copyEmitted(manifestPath, path.join(distDir, "manifest.json"));
+    }
 
     assertForbiddenTableCovered(forbiddenRecord);