fix: validate local web manifest icon refs (#3596)

Make derived manifest.json rewriting fail fast for missing local icon
refs instead of falling back to unhashed root paths.

Keep external and data URLs unchanged, and add regression coverage for
root-relative local icons, missing local icons, and passthrough
external/data refs.

If this PR fixes an issue, link it below. If not, delete these two
lines.
Resolves #(issue number)

## Description:

Describe the PR.

## Please complete the following:

- [ ] I have added screenshots for all UI updates
- [ ] I process any text displayed to the user through translateText()
and I've added it to the en.json file
- [ ] I have added relevant tests to the test directory
- [ ] I confirm I have thoroughly tested these changes and take full
responsibility for any bugs introduced

## Please put your Discord username so you can be contacted if a bug or
regression is found:

DISCORD_USERNAME

src/server/PublicAssetManifest.ts

@@ -4,7 +4,6 @@ import { globSync } from "glob";
 import path from "path";
 import {
   type AssetManifest,
-  buildAssetUrl,
   encodeAssetPath,
   normalizeAssetPath,
 } from "../core/AssetUrls";
@@ -97,6 +96,12 @@ function getEmittedAssetRelativePath(
   return path.posix.relative(emittedFromDir, emittedTargetPath);
 }
 
+function isExternalAssetReference(referencePath: string): boolean {
+  return (
+    /^[a-z][a-z0-9+.-]*:/i.test(referencePath) || referencePath.startsWith("//")
+  );
+}
+
 function renderWebManifestAsset({
   resourcesDir,
   assetManifest,
@@ -105,10 +110,38 @@ function renderWebManifestAsset({
   const manifest = JSON.parse(fs.readFileSync(sourcePath, "utf8")) as {
     icons?: Array<{ src?: string }>;
   };
-  manifest.icons = manifest.icons?.map((icon) => ({
-    ...icon,
-    src: buildAssetUrl(icon.src ?? "", assetManifest),
-  }));
+  manifest.icons = manifest.icons?.map((icon) => {
+    const src = icon.src;
+    if (src === undefined) {
+      return icon;
+    }
+
+    if (src.trim().length === 0) {
+      throw new Error(
+        "Derived asset manifest.json contains an icon with a blank src",
+      );
+    }
+
+    if (isExternalAssetReference(src)) {
+      return icon;
+    }
+
+    const referencedAssetPath = resolveDerivedAssetReference(
+      "manifest.json",
+      src,
+    );
+    const referencedHashedUrl = assetManifest[referencedAssetPath];
+    if (!referencedHashedUrl) {
+      throw new Error(
+        `Derived asset manifest.json references ${referencedAssetPath}, but it is missing from the asset manifest`,
+      );
+    }
+
+    return {
+      ...icon,
+      src: referencedHashedUrl,
+    };
+  });
   return `${JSON.stringify(manifest, null, 2)}\n`;
 }