tasks-runner 0001 R2: kicad_tools joins the CI build set + lint gates

docker/build.sh "all" now includes kicad_tools (finalizes in-container, so
it never contends with the editor's wasm-opt critical path); .ci-cache-epoch
bumped — the cached FINAL output set changes. wasm-build.yml gains the
corpus-lint + CLI-contract gate step (run_tests leg): with the artifact now
built in CI, the skip-when-unbuilt scripts bite. Release runs
(upload_output) start shipping kicad_tools in the wasm-output artifact —
the closed repo's runner-image workflow consumes it from there.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HLua64PCVwkQ1hpWdaf1Gm

.github/workflows/wasm-build.yml

@@ -379,6 +379,20 @@ jobs:
           corepack enable
           pnpm install --frozen-lockfile
 
+      # kicad_tools gates (tasks-runner 0001 R2): the corpus lint (fixtures +
+      # shared-codec round-trips — the wrapInBoardEnvelope-class E3 gate,
+      # kicad-validity 0001 §5) and the CLI contract the backend job runner
+      # keys off (exit codes, resave semantics). Both scripts skip when the
+      # artifact is absent, but "all" builds kicad_tools now, so here they
+      # bite. Needs tests npm deps (above) + web workspace deps (the corpus
+      # lint imports the shared codec).
+      - name: kicad_tools corpus lint + CLI contract
+        if: inputs.run_tests
+        working-directory: tests
+        run: |
+          npm run corpus:lint
+          npm run tools:contract
+
       # Browser binaries keyed on the lockfile (which pins the playwright version).
       # On a hit `playwright install` skips the downloads; --with-deps still
       # apt-installs its small OS dep set either way.