ci: dedupe validate into package, add caches, run phpunit in the shopware-cli image

- drop the separate validate job (the zip is validated after packaging); same in release
- shared scripts/ci/assert-built-assets.sh (BusyBox-safe), now also used by release
- actions/cache for npm, shopware-cli and composer
- phpunit: shopware-cli image instead of a 4.5 min apt install; MariaDB 10.11
  (11.4 broke Shopware's migrations: Duplicate column 'sorter_key')
- protect-main.sh: drop the removed validate context

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/plugin-checks.yml

@@ -1,7 +1,8 @@
 name: plugin-checks
 
 # Plugin-agnostic: nothing below names this plugin. Name, version and paths come from composer.json.
-# shopware-cli runs from its official Docker image, intentionally unpinned (latest); a red build after a CLI release means fix the config.
+# shopware-cli runs from its official Docker image, intentionally unpinned (latest); a red build
+# after a CLI release means fix the config.
 
 on:
   pull_request:
@@ -11,15 +12,8 @@ permissions:
   contents: read
 
 jobs:
-  validate:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/shopware/shopware-cli:latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Validate extension
-        run: shopware-cli extension validate .
-
+  # Packages the extension (builds admin/storefront assets) and validates the resulting zip,
+  # which is the artifact that ships. A separate directory validate would only repeat these checks.
   package:
     runs-on: ubuntu-latest
     container:
@@ -28,33 +22,29 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.npm
+            ~/.cache/shopware-cli
+          key: swcli-${{ runner.os }}-${{ hashFiles('composer.json', 'src/Resources/app/**/package*.json') }}
+          restore-keys: swcli-${{ runner.os }}-
       - name: Package extension
         run: shopware-cli extension package . --output-directory .build --filename package.zip --git-commit "$GITHUB_SHA"
       - name: Validate packaged zip
         run: shopware-cli extension validate .build/package.zip
-      - name: Ensure helper tools (jq, curl, unzip)
-        run: |
-          command -v jq >/dev/null && command -v curl >/dev/null && command -v unzip >/dev/null && exit 0
-          (apt-get update -q && apt-get install -y -q --no-install-recommends jq curl unzip) || apk add --no-cache jq curl unzip
       - name: Assert built JS is in the zip
-        run: |
-          set -e
-          LIST=$(unzip -Z1 .build/package.zip)
-          if [ -f src/Resources/app/administration/src/main.js ] || [ -f src/Resources/app/administration/src/main.ts ]; then
-            echo "$LIST" | grep -q 'Resources/public/administration/js/' || { echo "::error::admin entry exists but the zip has no built admin JS"; exit 1; }
-          fi
-          if [ -f src/Resources/app/storefront/src/main.js ] || [ -f src/Resources/app/storefront/src/main.ts ]; then
-            echo "$LIST" | grep -q 'Resources/app/storefront/dist/' || { echo "::error::storefront entry exists but the zip has no built storefront JS"; exit 1; }
-          fi
+        run: scripts/ci/assert-built-assets.sh .build/package.zip
 
   phpunit:
     runs-on: ubuntu-latest
-    # shivammathur/setup-php hangs on this runner, so PHP comes from Debian bookworm (8.2) via apt.
+    # Same image as above: it already ships PHP, Composer and Node, so no apt install.
     container:
-      image: node:20-bookworm
+      image: ghcr.io/shopware/shopware-cli:latest
     services:
       database:
-        image: mariadb:11.4
+        # Shopware 6.6 supports MariaDB 10.11 / MySQL 8; 11.4 broke Shopware's own migrations.
+        image: mariadb:10.11
         env:
           MARIADB_ROOT_PASSWORD: root
     env:
@@ -67,10 +57,15 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: plugin-src
-      - name: Install PHP and tools
-        run: |
-          apt-get update -q
-          apt-get install -y -q --no-install-recommends php-cli php-gd php-intl php-mysql php-zip php-curl php-mbstring php-xml php-bcmath composer unzip jq git ca-certificates
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/composer
+            ~/.composer/cache
+          key: composer-${{ runner.os }}-shopware-6.6-${{ hashFiles('plugin-src/composer.json') }}
+          restore-keys: composer-${{ runner.os }}-shopware-6.6-
+      - name: Toolchain
+        run: php -v && composer --version && php -m | tr '\n' ' '
       - name: Wait for the database
         run: |
           for i in $(seq 60); do
@@ -81,7 +76,7 @@ jobs:
       - name: Resolve plugin name
         run: |
           # plugin directory name = short class name of extra.shopware-plugin-class
-          CLASS=$(jq -r '.extra["shopware-plugin-class"]' plugin-src/composer.json)
+          CLASS=$(php -r 'echo json_decode(file_get_contents("plugin-src/composer.json"), true)["extra"]["shopware-plugin-class"];')
           echo "PLUGIN_NAME=${CLASS##*\\}" >> "$GITHUB_ENV"
       - name: Create Shopware 6.6 project
         run: composer create-project shopware/production:6.6.* shopware --no-interaction --no-scripts