feat: vendor and censor the phishing blocklist at build time (closes #219)

TODO.md

@@ -72,6 +72,29 @@ but the review is broader than any of them.
   the deletion of both persisted-value assignments in `settings.js` (only the
   selector round-trip case red)
   ([#229](https://git.eeqj.de/sneak/AutistMask/issues/229)).
+- 2026-08-17: The phishing blocklist is vendored at build time and censored, and
+  the runtime fetch is gone
+  ([#219](https://git.eeqj.de/sneak/AutistMask/issues/219)).
+  `script/vendor-blocklist` fetches upstream at a pinned commit, verifies the
+  sha256 of the bytes it was served, and writes
+  `src/shared/phishingBlocklist.json` as truncated sha256 digests rather than
+  domain names — which is what removes the competitor's name from a list that
+  carried it 6,475 times, without dropping a single one of those domains.
+  `script/check-censored` runs in `make check` and again against `dist/` at the
+  end of every build, each permitted occurrence scoped to the one path allowed
+  to carry it; the name now appears only in the vendoring script, which defines
+  it once, in the provider-shim identifiers in `src/content/inpage.js`, and in
+  one ERC-20's on-chain name in `src/shared/tokenList.js`. Removing the fetch
+  retired the delta, the persistence and the 24-hour alarm from
+  [#158](https://git.eeqj.de/sneak/AutistMask/issues/158), and retired alarms
+  are now cleared rather than left running on existing installs. Two
+  consequences, both deliberate: the list no longer self-updates, so it is as
+  fresh as the last vendoring run that was released; and re-vendoring from
+  current upstream took it from 231,357 stale entries to 105,721 current ones,
+  because upstream prunes and the vendored snapshot never did. `dist/` fell from
+  18.9 MB to 8.9 MB. The e2e suite now drives the warning end to end from a real
+  blocklisted origin, and its service-worker interception canary has a new
+  anchor, because the startup fetch it used to watch for no longer exists.
 - 2026-08-17: One wording for an empty password field on every screen that asks
   for one. The private key export screen said "Password is required." where the
   other five say "Please enter your password.", the same one-condition-two-
@@ -100,9 +123,10 @@ but the review is broader than any of them.
   and coverage change, not a repair of a broken target. `storageGet()` and
   `storageSet()` **reject** where `storage.local` is absent rather than
   resolving `{}` and a no-op write — they carry the wallet, and defaulting would
-  read an existing wallet back as none. The one caller that genuinely degrades,
-  [`src/shared/phishingDomains.js`](src/shared/phishingDomains.js), takes
-  `storageLocal()` directly and keeps its own null check.
+  read an existing wallet back as none. The one caller that genuinely degraded,
+  [`src/shared/phishingDomains.js`](src/shared/phishingDomains.js), took
+  `storageLocal()` directly and kept its own null check; it stores nothing at
+  all as of [#219](https://git.eeqj.de/sneak/AutistMask/issues/219) above.
 - 2026-08-17: An address total no longer reports `$0.00` for holdings it cannot
   price. Prices exist for the top 25 tokens only, so the priced-only sum was
   printed as the total and an address holding nothing but unpriced ERC-20s was