tasks-runner 0001 R2: kicad_tools joins the CI build set + lint gates

docker/build.sh "all" now includes kicad_tools (finalizes in-container, so
it never contends with the editor's wasm-opt critical path); .ci-cache-epoch
bumped — the cached FINAL output set changes. wasm-build.yml gains the
corpus-lint + CLI-contract gate step (run_tests leg): with the artifact now
built in CI, the skip-when-unbuilt scripts bite. Release runs
(upload_output) start shipping kicad_tools in the wasm-output artifact —
the closed repo's runner-image workflow consumes it from there.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HLua64PCVwkQ1hpWdaf1Gm

.ci-cache-epoch

@@ -1 +1 @@
-0
+1

.github/workflows/wasm-build.yml

@@ -379,6 +379,20 @@ jobs:
           corepack enable
           pnpm install --frozen-lockfile
 
+      # kicad_tools gates (tasks-runner 0001 R2): the corpus lint (fixtures +
+      # shared-codec round-trips — the wrapInBoardEnvelope-class E3 gate,
+      # kicad-validity 0001 §5) and the CLI contract the backend job runner
+      # keys off (exit codes, resave semantics). Both scripts skip when the
+      # artifact is absent, but "all" builds kicad_tools now, so here they
+      # bite. Needs tests npm deps (above) + web workspace deps (the corpus
+      # lint imports the shared codec).
+      - name: kicad_tools corpus lint + CLI contract
+        if: inputs.run_tests
+        working-directory: tests
+        run: |
+          npm run corpus:lint
+          npm run tools:contract
+
       # Browser binaries keyed on the lockfile (which pins the playwright version).
       # On a hit `playwright install` skips the downloads; --with-deps still
       # apt-installs its small OS dep set either way.

docker/build.sh

@@ -108,8 +108,11 @@ shift
 # host-side wasm-opt chain is the critical path and must start as early as
 # possible (especially with KICAD_PIPELINE=1). pcbnew/eeschema stay buildable as
 # standalone debug aids but are not part of "all" (not deployed).
+# kicad_tools joined "all" for the runner-image CI (tasks-runner 0001 R2) —
+# it finalizes in-container (no host wasm-opt tail), so it never contends
+# with the editor's critical path.
 if [[ "$APP_NAME" == "all" ]]; then
-    APPS=(kicad_editor occ_service calculator pl_editor gerbview)
+    APPS=(kicad_editor occ_service calculator pl_editor gerbview kicad_tools)
 else
     IFS=',' read -r -a APPS <<< "$APP_NAME"
     for app in "${APPS[@]}"; do