- Add build-shared step to web.yml so lint/typecheck/test can resolve @mosaic/shared types (same fix previously applied to api.yml) - Remove compiled .spec.js/.test.js files from orchestrator production image to prevent Trivy secret scanning false positives from test fixtures (fake AWS keys and RSA private keys in secret-scanner tests) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>