ci: dedupe validate into package, add caches, run phpunit in the shopware-cli image

- drop the separate validate job (the zip is validated after packaging); same in release
- shared scripts/ci/assert-built-assets.sh (BusyBox-safe), now also used by release
- actions/cache for npm, shopware-cli and composer
- phpunit: shopware-cli image instead of a 4.5 min apt install; MariaDB 10.11
  (11.4 broke Shopware's migrations: Duplicate column 'sorter_key')
- protect-main.sh: drop the removed validate context

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -49,9 +49,14 @@ jobs:
             echo "skip=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Validate extension
+      - uses: actions/cache@v4
         if: steps.meta.outputs.skip == 'false'
-        run: shopware-cli extension validate .
+        with:
+          path: |
+            ~/.npm
+            ~/.cache/shopware-cli
+          key: swcli-${{ runner.os }}-${{ hashFiles('composer.json', 'src/Resources/app/**/package*.json') }}
+          restore-keys: swcli-${{ runner.os }}-
 
       - name: Package extension (prebuilt admin/storefront assets)
         if: steps.meta.outputs.skip == 'false'
@@ -63,6 +68,10 @@ jobs:
         if: steps.meta.outputs.skip == 'false'
         run: shopware-cli extension validate ".build/${{ steps.meta.outputs.zip }}"
 
+      - name: Assert built JS is in the zip
+        if: steps.meta.outputs.skip == 'false'
+        run: scripts/ci/assert-built-assets.sh ".build/${{ steps.meta.outputs.zip }}"
+
       - name: Extract changelog section
         if: steps.meta.outputs.skip == 'false'
         run: |