The app icon's design source is pinned by no test #2611

The app icon's design source is pinned by no test, so a revert of its layer order or its node count passes every leg.

What is true today

packaging/assets/icon.svg is the design source for every packaging asset. packaging/gen-assets.sh renders it, and tests/test_gen_assets_keeps_the_icon_transparent.py guards the products: alpha channel preserved, corners transparent, .icns entries at their real sizes. That test reads the generator script, not the design. Its only statement about the source is MARGIN = 56.

So the properties the file itself carries are unmeasured:

• Layer order at the hub. The hub's three circles are painted after the branches. Painted before them — the state before the current design — the five round caps converge on the hub's face and the branch gradients' darkest stops land on it, which reads as a dark blotch.
• One light for the fan. branchGrad is a userSpaceOnUse radial gradient centred on the hub, so every branch darkens toward the centre and brightens toward its node. Under the default objectBoundingBox units each branch resolves the gradient against its own bounding box and the illumination scatters.
• Four nodes. The fan has four branches. A fifth, close enough to its neighbours, merges into a blob below 128 px.
• The body rectangle. x/y 56, width/height 912, rx 206 on a 1024 canvas — the app-icon shape every platform clips against.

Why no test covers it

The assertions could not exist before the current design landed: on the previous tree the hub circles preceded the branches and there were five of them, so a test asserting the present order or the present node count would have been red on the tree the change targeted. That is history, not a constraint any more.

What the fix must satisfy

1. A guard reads packaging/assets/icon.svg as XML and reports a fault for each property above, so a revert of any one of them reddens a leg.
2. The guard is exercised in both directions: the shipped file must pass, and a document with the old layering (hub before the branches, five branches) must be refused. An assertion that only ever sees the good file proves nothing.
3. It must not read the generated products — they are gitignored build output, and gen-assets.sh needs a renderer this project cannot assume on every runner.
4. No new dependency, and no change to icon.svg or to the generator.