fix(tools): name the clean, not the build, when .next cannot go

[G1NG4R]

The second half of #323's acceptance: "and if the build genuinely fails, the
script says so for the right reason."

rm -rf .next && npm run build reported the build's reason for both failures.
make dev runs its container as root, so what it leaves in .next/dev is
root-owned, rm cannot unlink it, and the run ended on npm run build failed
for a build that had never started — two hundred lines of Permission denied
above a message pointing at the wrong half. Four sightings, a quarter of an hour
each.

What changed

• The clean and the build are two commands, because they fail for two reasons.
• When the clean fails: the real rm line is shown, the message says the build
  never started, and the escape hatch is spelled out (a container of the same
  origin, not sudo).
• When the clean succeeds and the build fails: unchanged.

Both directions reproduced by hand against the real script:

  ✗ could not remove …/web/.next — the build never started
    rm: cannot remove '.next/dev/chunk.js': Permission denied

  ✗ npm run build failed — run it yourself to see why

The broken case, in selftest

bundle-size.sh was not in the fixture's copy list, so it had no coverage at
all. One refuses case now holds it: an unwritable directory is the same
refusal rm gives on root-owned files, without needing a container to make one.

Two traps avoided and noted in the source: the fixture's mode is restored
before the trap runs, because cleanup is itself rm -rf "$tmp" and would
otherwise fail on it — the same bug class this PR fixes; and the case is skipped
as root, where the mode bits are ignored and it would go red for a missing
package.json instead.

Verified red without the fix: rejected, but not for 'the build never started'.

What this does not do

#323 stays open. Its first clause — make dev then make bundle-size with
nothing deleted by hand — needs the decision the issue names and does not make:
run the dev container as node the way the production image already does, or
move the dev build output out of .next.

make check green; make check-tools green with the new case.