ci: merge version check into plugin-checks, share packaging as a composite action

- one PR workflow (plugin-checks) with version-changelog, package, phpunit jobs
- .gitea/actions/package: package + validate + assert, used by PR and release
- phpunit: FORCE_INSTALL so the TestBootstrapper installs its own test DB
- protect-main.sh: required context is now plugin-checks / version-changelog

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/actions/package/action.yml

@@ -0,0 +1,35 @@
+name: package-extension
+description: >-
+  Package the Shopware extension with shopware-cli (builds admin/storefront assets), validate the
+  zip and assert it contains the built JS. Shared by the PR checks and the release workflow.
+  Must run in the ghcr.io/shopware/shopware-cli image, after actions/checkout.
+
+inputs:
+  filename:
+    description: Name of the zip written to .build/
+    default: package.zip
+  build:
+    description: "'false' skips packaging (a prebuilt zip is already in .build/) and only validates it"
+    default: 'true'
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/cache@v4
+      if: inputs.build == 'true'
+      with:
+        path: |
+          ~/.npm
+          ~/.cache/shopware-cli
+        key: swcli-${{ runner.os }}-${{ hashFiles('composer.json', 'src/Resources/app/**/package*.json') }}
+        restore-keys: swcli-${{ runner.os }}-
+    - name: Package extension
+      if: inputs.build == 'true'
+      shell: bash
+      run: shopware-cli extension package . --output-directory .build --filename "${{ inputs.filename }}" --git-commit "$GITHUB_SHA"
+    - name: Validate packaged zip
+      shell: bash
+      run: shopware-cli extension validate ".build/${{ inputs.filename }}"
+    - name: Assert built JS is in the zip
+      shell: bash
+      run: scripts/ci/assert-built-assets.sh ".build/${{ inputs.filename }}"