build(ui): build core.wasm in CI, stop committing the binary (F6)

core.wasm and wasm_exec.js are no longer tracked (untracked + gitignored).
A reusable composite action .gitea/actions/build-wasm installs TinyGo
(actions/cache'd) and runs `make -C ui wasm`; it runs in all three
frontend-building workflows — ui-test (before Playwright; Vitest uses the
fake Core and needs no build), dev-deploy, and prod-build. ui-test gains a
Go setup (TinyGo shells out to Go); the deploy workflows already had one.

Docs: ui/docs/wasm-toolchain.md, ui/README.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ui/PLAN-finalize.md

@@ -133,7 +133,19 @@ Acceptance: installs as a PWA on Chrome, Edge, and iOS Safari; the SW
 survives an app update without serving stale code. Tests: Lighthouse PWA
 ≥ 90; Playwright install→offline→cached-login; version-bump invalidation.
 
-## F6 — Build hygiene: build core.wasm in CI
+## F6 — Build hygiene: build core.wasm in CI — done
+
+`core.wasm` / `wasm_exec.js` are no longer committed (untracked +
+gitignored). A reusable composite action
+`.gitea/actions/build-wasm` installs TinyGo (`actions/cache`d) and runs
+`make -C ui wasm`; it is invoked by **all three** frontend-building
+workflows — `ui-test` (before Playwright; Vitest needs no build, it uses
+the fake Core), `dev-deploy`, and `prod-build` (which build the bundle on
+the runner via `pnpm build`, then package it). `ui-test` gained a Go
+setup; the deploy workflows already had one. Docs:
+`ui/docs/wasm-toolchain.md`, `ui/README.md`.
+
+
 
 (From the PLAN.md TODO; timely — the binary is currently committed and
 must be rebuilt by hand on every Go-bridge change, which has already