docs: record brand asset rollout

docs/verification.md

@@ -591,6 +591,46 @@ single native `details` menu; wider layouts show the same actions inline.
   accessible menu contents, no horizontal overflow, and zero console errors or
   warnings. The visible browser was left open at 1030 px with the menu closed.
 
+## Brand icon follow-up
+
+Commit `c28c9a3` replaced the placeholder Phoenix mark with the selected
+Who Need Help symbol. The symbol remains image-only while the header name stays
+as accessible HTML text.
+
+- One source SVG reproducibly generates 48 px browser fallback, PWA 192/512,
+  maskable 512/1024, Apple touch 180, Apple-ready 1024, Google Play 512, and
+  legacy Android density assets through `scripts/generate-brand-assets.sh`.
+  The Google Play file is 512×512, 8-bit RGBA PNG, and 27,107 bytes.
+- The PWA manifest separates `any`, `maskable`, and `monochrome` purposes.
+  Android API 26+ uses foreground/background adaptive layers, API 33+ adds a
+  monochrome layer, and API 24/25 retain generated density resources. The
+  notification small icon is now a dedicated monochrome vector rather than the
+  launcher artwork.
+- The pinned Android SDK 37 Docker build passed JVM unit tests, `lintDebug`,
+  `assembleDebug`, and `assembleDebugAndroidTest`. The exported debug APK and
+  lint report are under `android/dist/`.
+- `./scripts/quality.sh` passed with 173 ExUnit tests and every static,
+  dependency, security, manifest, and image gate. Evidence is
+  `output/regression/brand-assets-quality-20260719.log`.
+- The isolated responsive/accessibility browser suite passed 6/6 across
+  Chromium, Firefox, and WebKit. Evidence is
+  `output/e2e/20260719193958-2786366`.
+- Before rollout, mode-`0600`
+  `output/backups/compose-before-brand-20260719-194155.dump` was created with
+  SHA-256
+  `9be1197a02783b959e2eee783c6d74b4bf2a65a581c6a4566f0e815c7465ea61`.
+  Its isolated restore retained 24 public tables, the observed domain counts,
+  all 10 migrations, and PostGIS 3.6.4; the temporary database was removed.
+- Public image ID
+  `sha256:8db2281f2cf51b787fc22d99f2911ee870c9ee66a0ae6e9b801796ab1aff605f`
+  runs on 2 healthy web and 2 running worker replicas. The before/after
+  database snapshots are byte-identical and cross-node PubSub passed.
+- Every public brand URL, the manifest, service worker, homepage, and readiness
+  endpoint returned HTTP 200. Public and repository SVG SHA-256 values matched.
+  Headed Chrome showed the new 36×36 header mark at 1030 px with no overflow or
+  console messages. Service worker `v2` activated and removed the old `v1`
+  cache. Evidence is `output/brand/public-header-1030-20260719.png`.
+
 ## Known work before a public production launch
 
 - Replace the temporary staging origin with the production-owned domain and