test: lock in the field-specific startup error with static, mutation and deterministic probes (E00-S04-T02)

- tests/config-startup-error.test.mjs: static assertions on the committed
  startup-error module, the package boundary, the server wiring (validation
  before bind), the compose secret and the Dockerfile shipping, each backed
  by mutation probes; the deterministic probes execute the issue's test plan
  ("start with a missing required field and confirm the error names it") —
  the compiled boundary throws MissingRequiredSettingError naming
  sessionSecret, and booting the committed server without EPPP_SESSION_SECRET
  exits non-zero naming the field while a valid secret boots to /health 200
- health-endpoint/app-readiness boot probes: provide a valid
  EPPP_SESSION_SECRET (the required setting is validated at startup)
- ci.yml: new config-startup-error job (builds config + database-postgres,
  runs the suite); app-readiness job now builds the config package too
- .gitignore: transient .config-startup-probe-*.mjs files

.gitea/workflows/ci.yml

@@ -145,10 +145,11 @@ jobs:
   # migration run is blocked behind a held ACCESS EXCLUSIVE lock on the
   # migration ledger, /health stays not-ready, then flips ready once the lock
   # releases) runs where a Docker daemon is available and skips cleanly
-  # otherwise. The job installs the frozen workspace and builds the
-  # database-postgres package because the probes boot the committed server
-  # from the host (it imports @personal-blog/database-postgres through the
-  # package's own links).
+  # otherwise. The job installs the frozen workspace and builds the config
+  # and database-postgres packages because the probes boot the committed
+  # server from the host (it imports @personal-blog/config and
+  # @personal-blog/database-postgres through the packages' own links; the
+  # required EPPP_SESSION_SECRET is provided by the probe's boot env).
   app-readiness:
     name: App readiness after migrations (E00-S03-T06)
     runs-on: ubuntu-latest
@@ -162,11 +163,40 @@ jobs:
         run: corepack enable
       - name: Install dependencies (frozen lockfile)
         run: pnpm install --frozen-lockfile
-      - name: Build the database-postgres package (the probes boot the committed server which imports it)
-        run: pnpm --filter @personal-blog/database-postgres build
+      - name: Build the config and database-postgres packages (the probes boot the committed server which imports them)
+        run: pnpm --filter @personal-blog/config build && pnpm --filter @personal-blog/database-postgres build
       - name: Run app readiness test suite
         run: node --test tests/app-readiness.test.mjs
 
+  # E00-S04-T02: the static assertions of tests/config-startup-error.test.mjs
+  # gate every PR — the suite locks in the field-specific startup error (a
+  # missing required setting fails startup with an error naming the missing
+  # field: packages/config's MissingRequiredSettingError/assertValidConfig,
+  # wired into the committed server before it binds) with mutation probes, and
+  # the deterministic probes execute the issue's test plan ("start with a
+  # missing required field and confirm the error names it"): booting the
+  # committed server without EPPP_SESSION_SECRET exits non-zero naming
+  # sessionSecret, while a valid secret boots to GET /health 200. The job
+  # installs the frozen workspace and builds the config and database-postgres
+  # packages because the probes boot the committed server which imports them.
+  config-startup-error:
+    name: Field-specific startup errors (E00-S04-T02)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Node.js 24
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+      - name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
+        run: corepack enable
+      - name: Install dependencies (frozen lockfile)
+        run: pnpm install --frozen-lockfile
+      - name: Build the config and database-postgres packages (the probes boot the committed server which imports them)
+        run: pnpm --filter @personal-blog/config build && pnpm --filter @personal-blog/database-postgres build
+      - name: Run config startup error test suite
+        run: node --test tests/config-startup-error.test.mjs
+
   # E00-S04-T01: the static assertions of tests/config-schema.test.mjs gate
   # every PR — the suite locks in the TypeBox/Ajv configuration schema
   # (packages/config, golden-tuple pins @sinclair/typebox@0.34.52 +