ci(web): add precise wasm-freshness gate; drop flawed drift heuristic

The web build shipped a ~3-week-stale pkg/ because the old "Check wasm pkg
drift" step in docker-build.yml only hard-failed on direct solitaire_web/
edits and treated solitaire_engine/_core changes as a non-blocking notice —
so the entire card_game migration (engine/core/data churn, v4->v5 save
schema) slipped through.

Replace it with a dedicated `web-wasm-freshness` workflow that rebuilds the
artifacts and diffs them against what's committed. A fresh build on a pinned
toolchain (rust 1.95.0 / wasm-bindgen 0.2.120 / wasm-pack 0.14.0 / binaryen
130) is byte-for-byte reproducible — verified locally — so this is precise:
it fails on *any* real drift (including gameplay-logic changes that don't
touch the JS API surface) and has no false positives on wasm-irrelevant edits.
Runs on pull_request as well as master push, so staleness is caught before
merge rather than only blocking the post-merge deploy.

Remove the superseded heuristic from docker-build.yml; master stays fresh via
the PR gate, so the deploy image is always built from current artifacts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/docker-build.yml

@@ -36,47 +36,12 @@ jobs:
         id: meta
         run: echo "sha=${GITHUB_SHA::8}" >> "$GITHUB_OUTPUT"
 
-      - name: Check wasm pkg drift
-        run: |
-          set -euo pipefail
-          BASE_SHA="${{ github.event.before }}"
-          HEAD_SHA="${{ github.sha }}"
-          if [ -n "$BASE_SHA" ] && git cat-file -e "$BASE_SHA^{commit}" 2>/dev/null; then
-            RANGE="$BASE_SHA..$HEAD_SHA"
-          else
-            RANGE="HEAD~1..HEAD"
-          fi
-
-          CHANGED="$(git diff --name-only "$RANGE")"
-          echo "Changed files:"
-          echo "$CHANGED"
-
-          if echo "$CHANGED" | grep -Eq '^(solitaire_wasm/|solitaire_core/|Cargo\.toml|Cargo\.lock)$|^(solitaire_wasm/|solitaire_core/)'; then
-            if ! echo "$CHANGED" | grep -Eq '^solitaire_server/web/pkg/solitaire_wasm\.js$|^solitaire_server/web/pkg/solitaire_wasm_bg\.wasm$'; then
-              echo "error: wasm/core/Cargo changed but committed web pkg artifacts are missing."
-              echo "Run: wasm-pack build --target web --out-dir solitaire_server/web/pkg --no-typescript solitaire_wasm"
-              exit 1
-            fi
-          fi
-
-          # Hard check: solitaire_web/ is the direct Bevy WASM source — any
-          # change there MUST rebuild canvas_bg.wasm or the binary goes stale.
-          if echo "$CHANGED" | grep -Eq '^solitaire_web/'; then
-            if ! echo "$CHANGED" | grep -Eq '^solitaire_server/web/pkg/canvas_bg\.wasm$'; then
-              echo "error: solitaire_web/ changed but canvas_bg.wasm not updated."
-              echo "Run: ./build_wasm.sh  (requires wasm-bindgen-cli + wasm32-unknown-unknown target)"
-              exit 1
-            fi
-          fi
-
-          # Advisory notice: solitaire_engine/ and solitaire_core/ changes often
-          # require a Bevy WASM rebuild but are not enforced (formatting-only
-          # commits should not be blocked).
-          if echo "$CHANGED" | grep -Eq '^(solitaire_engine/|solitaire_core/)' && \
-             ! echo "$CHANGED" | grep -Eq '^solitaire_server/web/pkg/canvas_bg\.wasm$'; then
-            echo "notice: solitaire_engine/core changed without a canvas_bg.wasm rebuild."
-            echo "        If the change affects gameplay run ./build_wasm.sh before pushing."
-          fi
+      # WASM artifact freshness is enforced precisely by the dedicated
+      # `web-wasm-freshness` workflow (rebuild-and-diff on every PR + master
+      # push), which supersedes the previous changed-files heuristic here.
+      # That heuristic only hard-failed on direct solitaire_web/ edits and
+      # treated solitaire_engine/_core changes as a non-blocking notice, which
+      # let the whole card_game migration ship a stale pkg/.
 
       - name: Log in to Gitea registry
         uses: docker/login-action@v3