ci: dedupe validate into package, add caches, run phpunit in the shopware-cli image

- drop the separate validate job (the zip is validated after packaging); same in release
- shared scripts/ci/assert-built-assets.sh (BusyBox-safe), now also used by release
- actions/cache for npm, shopware-cli and composer
- phpunit: shopware-cli image instead of a 4.5 min apt install; MariaDB 10.11
  (11.4 broke Shopware's migrations: Duplicate column 'sorter_key')
- protect-main.sh: drop the removed validate context

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

scripts/ci/assert-built-assets.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Assert that a packaged extension zip contains the built admin/storefront JS when the sources exist.
+# Usage: scripts/ci/assert-built-assets.sh <zip>   (run from the repo root; BusyBox-safe: uses unzip -l)
+set -euo pipefail
+ZIP="${1:?usage: assert-built-assets.sh <zip>}"
+LIST=$(unzip -l "$ZIP")
+
+check() { # <label> <entry-glob-prefix> <expected path in zip>
+  local label="$1" entry="$2" expected="$3"
+  if [ -f "${entry}/main.js" ] || [ -f "${entry}/main.ts" ]; then
+    echo "$LIST" | grep -q "$expected" || { echo "::error::${label} entry exists but the zip has no built ${label} JS (${expected})"; exit 1; }
+    echo "ok: ${label} JS is in the zip"
+  fi
+}
+
+check admin src/Resources/app/administration/src "Resources/public/administration/js/"
+check storefront src/Resources/app/storefront/src "Resources/app/storefront/dist/"

scripts/protect-main.sh

@@ -10,7 +10,6 @@ tea api -X PATCH "repos/${REPO}/branch_protections/main" -d '{
   "enable_status_check": true,
   "status_check_contexts": [
     "version-changelog / version-changelog (pull_request)",
-    "plugin-checks / validate (pull_request)",
     "plugin-checks / package (pull_request)",
     "plugin-checks / phpunit (pull_request)"
   ]