fix(ci): build the engine package before the self-host Postgres integration test

[JSONbored]

Summary

• .github/workflows/selfhost.yml's "build + boot smoke test" job runs the Postgres integration test (test/integration/selfhost-pg.test.ts) right after npm ci --ignore-scripts, with no step building @jsonbored/gittensory-engine's dist/ output first.
• That test's import graph now reaches the engine package transitively: it imports processJob from src/queue/processors.ts, which imports src/mcp/local-write-tools.ts, which (since refactor(engine): move local-write action specs into the shared engine package #5117 moved local-write action specs into the shared engine package) re-exports from @jsonbored/gittensory-engine. The package's dist/ is gitignored and only exists after npm run build --workspace @jsonbored/gittensory-engine — this workflow never had that step because it never needed it before.
• Same #ci-engine-build-order bug class ci.yml's own "Build engine package" step exists to prevent (see its comment, first hit by PR fix(miner-governor): wire buildHouseRulesPreToolUseHook into a real driver-construction call site #5082, fixed by fix(ci): build the engine package before Typecheck, not just before coverage #5093 for Typecheck/coverage) — just missed in this separate workflow.
• Discovered as a side effect while opening an unrelated PR (feat(selfhost): wire native Docker Compose secrets for the gittensory service #5121, Docker Compose secrets) that happens to touch docker-compose.yml, one of this workflow's trigger paths — it's the first PR to actually exercise selfhost.yml since refactor(engine): move local-write action specs into the shared engine package #5117 landed, surfacing a break that's been latent on main since then. Confirmed this is not required-check-blocking (only validate + Superagent Security Scan are required) and not caused by that PR's own diff, so fixing it here as its own focused change instead.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• Maintainer/own-branch PR — no linked issue; this is a CI-only fix for a regression discovered this session, landed directly.

Validation

• npm run actionlint — clean.
• Reproduced the exact CI failure locally: removed packages/gittensory-engine/dist, ran npx vitest run test/integration/selfhost-pg.test.ts, got the identical Failed to resolve entry for package "@jsonbored/gittensory-engine" error at src/review/fix-handoff-render.ts:14:1 / src/mcp/local-write-tools.ts:8:1.
• Rebuilt via npm run build --workspace @jsonbored/gittensory-engine (the exact command now added to the workflow), re-ran the test: resolves cleanly, 6 tests skip (no PG_TEST_URL locally — expected, matches the test file's own documented local-run instructions).

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — CI workflow change only.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A.)
• No UI change — UI Evidence section not applicable.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.32%. Comparing base (46d63b9) to head (0417791).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5122   +/-   ##
=======================================
  Coverage   94.32%   94.32%           
=======================================
  Files         471      471           
  Lines       39821    39821           
  Branches    14533    14533           
=======================================
  Hits        37560    37560           
  Misses       1583     1583           
  Partials      678      678           

Flag	Coverage Δ
shard-1	46.34% <ø> (ø)
shard-2	34.66% <ø> (ø)
shard-3	32.09% <ø> (ø)
shard-4	32.01% <ø> (ø)
shard-5	33.58% <ø> (ø)
shard-6	44.87% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[gittensory-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 Gittensory is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}