ci: build the control-plane app in the gate (next build) - the app build was never machine-verified (coreci-chat#10)

The M2 acceptance gate requires both jobs GREEN, but no step in either job ran
`next build`: the workflow builds the eight library packages and typechecks and
lints the app, so the App Router tree itself was never compiled by a machine.
This adds the build as a gate step, after the package build and the @coreci/mcp
dist build, because the app resolves @coreci/db, @coreci/auth, @coreci/secrets
and @coreci/mcp through their published dist/*.d.ts.

coreci-chat#10 closes on a green app build on main.

.gitea/workflows/ci.yml

@@ -97,6 +97,14 @@ jobs:
       - name: Build (mcp package — dist for the smoke imports)
         run: pnpm --filter @coreci/mcp build
 
+      # The app build is the M2 gate's missing leg (coreci-chat#10): `next
+      # build` is the only check that proves the App Router tree (root layout,
+      # route handlers, pages) compiles. The workspace packages are built
+      # above because the app resolves @coreci/db, @coreci/auth,
+      # @coreci/secrets and @coreci/mcp through their published dist/*.d.ts.
+      - name: Build (control-plane app - next build)
+        run: pnpm --filter @coreci/control-plane build
+
       - name: "[G-018,R-008] Import guard (no @coreci/llm-mock in prod source)"
         run: pnpm check:llm-mock-guard