ADR-013 Phase 5: CI lean-build job (delete-a-plugin guarantee)

New CI job builds a lean site (machines + printers) via build-site.sh and
asserts omitted-plugin code (PartsKiosk, ManifestEditor, USBLabelBatch,
KnowledgeBaseDetail) is absent from the bundle while chosen-plugin code is
present, and that only chosen plugin dirs stage into the backend. Locks the
lean-build guarantee so a future change cannot silently pull an unchosen plugin
into a per-site build.

.github/workflows/ci.yml

@@ -50,6 +50,42 @@ jobs:
       - run: npx vitest run
       - run: npm run build
 
+  lean-build:
+    # ADR-013 Phase 5: prove a per-site build carries only its chosen plugins.
+    # Builds a lean site (machines + printers) and asserts an omitted plugin's
+    # code is absent from the bundle - the delete-a-plugin guarantee in CI.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - run: cd frontend && npm ci
+      - name: Build lean site (machines + printers)
+        run: |
+          printf '{ "site": "ci-lean", "plugins": ["machines", "printers"] }' \
+            > /tmp/lean-profile.json
+          bash scripts/build-site.sh /tmp/lean-profile.json /tmp/leansite
+      - name: Assert omitted plugin code is absent, chosen present
+        run: |
+          assets=/tmp/leansite/frontend-dist/assets
+          for code in PartsKiosk ManifestEditor USBLabelBatch KnowledgeBaseDetail; do
+            if grep -rqoh "$code" "$assets"/*.js; then
+              echo "FAIL: omitted-plugin code '$code' leaked into the lean bundle"
+              exit 1
+            fi
+          done
+          for code in MachineDetail PrinterDetail; do
+            grep -rqoh "$code" "$assets"/*.js || {
+              echo "FAIL: chosen-plugin code '$code' missing from the lean bundle"
+              exit 1; }
+          done
+          test -d /tmp/leansite/plugins/machines
+          test ! -d /tmp/leansite/plugins/printedparts
+          echo "lean build verified: only chosen plugins present"
+
   migrations-mysql:
     runs-on: ubuntu-latest
     services: