fix(deps): drop electron-icon-builder from the install path

[killerwolf]

Closes #34.

The problem

electron-icon-builder drags a deprecated phantomjs-prebuilt into the tree:

electron-icon-builder@2.0.1 → icon-gen@2.1.0 → svg2png@4.1.1 → phantomjs-prebuilt@2.1.16

Its postinstall downloads a 17 MB binary from GitHub release assets on every clean install. When that request fails, npm ci fails outright — which is what took down the main run after #31 merged:

npm error PhantomJS not found on PATH
npm error Downloading https://github.com/Medium/phantomjs/releases/download/v2.1.1/phantomjs-2.1.1-macosx.zip
npm error Status: 504

The asset itself is fine — it returns 200 and the full 17 MB on request. The fragility is having a third-party download in the critical path of every install at all: it fails at random rather than staying broken, so it can't be waited out.

Why it can just go

Nothing in the app, the tests or CI needs it:

• No workflow runs build:icons.
• scripts/build-icons.js already invokes it through npx, not an import — so it never needed to be installed.

It exists for npm run build:icons, run by hand when the icon changes. Removing it from devDependencies takes PhantomJS out of every install and leaves the cost with the one task that actually needs it.

npx prompts before installing a package it doesn't have, which would hang a non-interactive shell, so the call now passes --yes.

Verified

Clean install — rm -rf node_modules && npm ci:

added 678 packages in 33s
phantomjs               → absent from node_modules
electron-icon-builder   → absent from node_modules
phantomjs in lockfile   → 0 occurrences

Icon generation still works — ran npm run build:icons with the package absent, and it regenerated every icon from icon.svg through npx --yes. The output is byte-identical to what's committed; git status assets/ is clean and all eight files keep their SHA-256:

3f594b33…  assets/icon.icns
2be68ca9…  assets/icon.png
88f01367…  assets/icon-256.png

Full gate — lint, format, typecheck, 54 tests, build, and the boot smoke test all pass.

Trade-off, stated plainly

Rebuilding icons still pulls PhantomJS — this moves that cost to the one manual task rather than removing it. #34 notes the larger alternative: build-icons.js already uses sharp for the 1024×1024 master, so only the .icns/.ico packing needs an external tool, and a maintained packer would drop the deprecated chain entirely. Not attempted here.

🤖 Generated with Claude Code