Prebuild a full iconutil ICNS (including 1024) instead of converting a lone 512 PWA PNG, validate Dock-critical types at package verify time, and set the Dock icon at runtime as a Launch Services cache fallback.
