fix(build): put wails3 on PATH for the Taskfile supervisors

`make sandbox`, `make dev`, `make build-dev` and `make build-prod` all
died with "/bin/sh: wails3: command not found". `wails3 dev` and
`wails3 task` are supervisors: they run the scaffold's Taskfile tree,
which invokes `wails3` by bare name in 54 places across four files. The
CLI is a vendored Go tool by design (plan 009, D3 — a global install
would be this build's first undeclared dependency), so that name did
not exist.

scripts/toolbin/wails3 execs `go tool wails3`, and the Makefile
prepends that directory only for the targets that start a supervisor.
Rewriting 54 scaffold call sites would be churn to redo on every
scaffold refresh; nothing global is installed either way.

The shim does not cd. The first version did, to be sure `go tool` found
the module — it does not need to — and that silently discarded the
`dir:` a task had set, so generate:icons failed with "open
appicon.png: no such file or directory" against a file that was there.

Three things the build path needed once it got that far:

- `frontend/package.json` gains `build:dev`, which build:frontend runs
  under DEV=true and which did not exist.
- Vite binds 127.0.0.1. It defaulted to `localhost`, which resolves to
  `[::1]` only here, while wails3 dev's asset proxy dials IPv4 — so the
  first request for the dev server was refused and the first paint
  raced a retry. Zero proxy errors after.
- The icons and the .desktop file are generated on every build.
  icons.icns/icon.ico are deterministic from our appicon.png (verified
  by regenerating), so the regenerated pair is committed and the churn
  ends; .task/ and the .desktop file are ignored.

Also corrects a claim: build-prod strips and trims but does **not**
UPX-compress — that was v2's `-upx` flag. Phase 1 recorded UPX as
still working, but neither build target had been run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UDCbcCZQepnpSQYJ6SxxZm

.planning/plans/active/009-wails-v3-migration.md

@@ -294,6 +294,14 @@ Taskfile tree — a genuinely larger and more visible build surface.
 `make build-prod` still strips and UPX-compresses; `make skill-check`
 passes; `grep -r webkit2_41` returns nothing.
 
+> **Corrected after the fact.** `make build-prod` strips and trims
+> (`-trimpath -ldflags="-w -s"`, 28.8 MB against the dev build's
+> 38 MB) but **does not UPX-compress**: that was v2's `wails build
+> -upx` flag, and v3's Taskfile has no equivalent. Neither `make
+> build-dev` nor `make build-prod` was actually run when Phase 1 was
+> recorded — both were broken until the shim below. Whether to
+> reintroduce UPX is a packaging decision for Phase 7, not a port.
+
 **Est.** Half a session. Low risk, high churn.
 
 ### Phase 1 — what actually landed