feat(build): run the contract checker on every installed artifact

[oto-macenauer-absa]

Follow-up to #100. The knowledge base build now runs the same contract checker the publish-docs action runs (actions/lib/check.js, rules in contract/RULES.md), on every artifact it installs.

Why

Not every artifact in a registry went through a current action:

• one published before a rule existed;
• one packed by hand;
• one whose HTML the old v1.0.0 pattern-matching missed, for example a root-relative URL in a single-quoted attribute or in formaction.

The build repairs some findings as it re-hosts a page, so a failing publish is not the only signal a registry owner needs. They need to see which docs repo to chase, and for what.

What

• scripts/check-artifact.js checks each app as installed into apps/, before inline scripts are hoisted, on every source (prebuilt and local included).
  • Findings are logged grouped by rule: one line per rule with a count and the first example, then a per-artifact summary.
  • Example from the vendored fixture: KB-HTML-004 ×9, e.g. user-guide/admin/index.html: …, then 0 error(s), 28 warning(s).
• A strict build refuses an artifact with an error finding. Strict is KB_STRICT, which the deployment workflow turns on by default. The error names the rule and the file. Warnings never fail a build.
• Replaced: the build's old headless-marker warning, which only looked at the entry page.
• Dependencies: htmlparser2 and postcss are now root dependencies, pinned at the versions actions/package.json pins.
  • check.js resolves them from actions/node_modules when that is installed, otherwise from the root.
  • CI's E2E job installs only the root.
  • tests/artifact-checks.spec.js fails if the two pins drift.

⚠️ Deployment impact

Strict is on by default in build-image.yml, so after this merges a deployment build fails if any registered artifact has an error finding.

Artifacts published by the v1 action should pass: the action has refused these error rules since v1.0.0. The remaining risk is:

• an artifact that did not come from the action;
• a pattern the old checks missed.

To check a deployment registry before rolling this out, run a non-strict build of it. It logs every finding without failing.

Testing

• npm test: 382 of 382 passed, including the 10 new tests.
• npm run selftest in actions/ passes.
• Checked the root-only path, as CI's E2E job has it: with actions/node_modules moved aside, the hermetic build and artifact-checks.spec.js both pass.
• contract/DEPLOYMENT.md gains the new strict-rejection row, and RULES.md and CLAUDE.md are updated.

Refs #67. The build now logs inline handlers (KB-HTML-005) per artifact; it still does not strip them.

🤖 Generated with Claude Code