fix(ci): fix pipeline #365 — web build-shared + orchestrator secret scan

- Add build-shared step to web.yml so lint/typecheck/test can resolve
  @mosaic/shared types (same fix previously applied to api.yml)
- Remove compiled .spec.js/.test.js files from orchestrator production
  image to prevent Trivy secret scanning false positives from test
  fixtures (fake AWS keys and RSA private keys in secret-scanner tests)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.woodpecker/web.yml

@@ -43,6 +43,16 @@ steps:
     depends_on:
       - install
 
+  build-shared:
+    image: *node_image
+    environment:
+      SKIP_ENV_VALIDATION: "true"
+    commands:
+      - *use_deps
+      - pnpm --filter "@mosaic/shared" build
+    depends_on:
+      - install
+
   lint:
     image: *node_image
     environment:
@@ -51,7 +61,7 @@ steps:
       - *use_deps
       - pnpm --filter "@mosaic/web" lint
     depends_on:
-      - install
+      - build-shared
 
   typecheck:
     image: *node_image
@@ -61,7 +71,7 @@ steps:
       - *use_deps
       - pnpm --filter "@mosaic/web" typecheck
     depends_on:
-      - install
+      - build-shared
 
   test:
     image: *node_image
@@ -71,7 +81,7 @@ steps:
       - *use_deps
       - pnpm --filter "@mosaic/web" test
     depends_on:
-      - install
+      - build-shared
 
   # === Build ===