ci(web): Phase P6 — vite build in PR CI + headless E2E gate on trunk publishes (#1445)

- ci.yml: build step (vite build via turbo) runs on every PR pipeline after test
- publish.yml: e2e step boots the gateway from built dist (HOME/cwd-isolated
  throwaway PGlite) and runs the Playwright suite headless inside
  mcr.microsoft.com/playwright:v1.58.2-noble against the SPA bundle served
  exactly as production serves it; both kaniko publishes now gate on e2e
- serve-spa.ts: strip query strings before asset resolution; immutable
  cache-control for hashed assets (onSend hook); e2e spec covers both
- e2e suite hardened: globalSetup seeds admin+member through real
  bootstrap/better-auth APIs (Origin header for CSRF), loginAs waits for the
  post-login redirect (fixes 27-skipped race), stale #152-era assertions
  rewritten to the current command-driven UI, strict-mode violations fixed
  with level-1 heading queries and .or() auto-retrying locators
- verify-release mirrors the new build stage; playwright artifacts ignored

scripts/verify-release.test.mjs

@@ -228,9 +228,10 @@ steps:
 function assertStagesMirrorCi(stages, ci) {
   const canonical = Object.fromEntries(stages.map((stage) => [stage.name, stage.commands]));
 
-  // The complete mandatory set, in gate order. `quality-rails` is a
-  // canonical-only stage (RI-N4, QC-19): like `build`, it has no ci.yml
-  // mirror to match — its contract is asserted separately below.
+  // The complete mandatory set, in gate order. `quality-rails` is the one
+  // canonical-only stage (RI-N4, QC-19) with no ci.yml mirror to match — its
+  // contract is asserted separately below. `build` gained a ci.yml mirror in
+  // #1445 (P6) and is enforced with the other pnpm stages.
   assert.deepEqual(
     stages.map((stage) => stage.name),
     [
@@ -257,7 +258,7 @@ function assertStagesMirrorCi(stages, ci) {
 
   // pnpm stages: ci.yml commands minus `corepack enable` must be exactly the
   // canonical stage commands.
-  for (const stepName of ['typecheck', 'lint', 'format']) {
+  for (const stepName of ['typecheck', 'lint', 'format', 'build']) {
     assert.deepEqual(
       ci.steps[stepName].commands.filter((command) => command !== 'corepack enable'),
       canonical[stepName],