CI builds and lints every plan with this portal

The check portal-trainer's CI ran with the standalone trainer, which
kept failing on a builder bug fixed here long ago. Now it runs where the
trainer lives, with the same binary.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MznPTC31w5mSUK4XMehcpi

.gitea/workflows/test.yml

@@ -38,6 +38,25 @@ jobs:
       - name: Test
         run: cargo test --features ssr
 
+      # Every plan under plans/ built deterministically and held to the
+      # lint, both by this very portal: a builder change that renders a
+      # site the lint rejects fails here, not at the next training run.
+      # (portal-trainer's CI did this until the trainer moved in.)
+      - name: Build and lint every plan
+        run: |
+          set -euo pipefail
+          cargo build --features ssr --bin portal
+          bin="$CARGO_TARGET_DIR/debug/portal"
+          tmp=$(mktemp -d)
+          lint="$tmp/portal-lint"
+          printf '#!/bin/sh\nexec %s lint "$@"\n' "$bin" > "$lint" && chmod +x "$lint"
+          for plan in plans/*.yaml; do
+            name=$(basename "$plan" .yaml)
+            echo "== $plan"
+            rm -rf "$tmp/plan-$name"
+            "$bin" build --plan "$plan" --out "$tmp/plan-$name" --lint "$lint"
+          done
+
       - name: Stop the throwaway JetStream
         if: always()
         run: docker rm -f portal-test-nats >/dev/null 2>&1 || true