test: lock in the field-specific startup error with static, mutation and deterministic probes (E00-S04-T02)

- tests/config-startup-error.test.mjs: static assertions on the committed
  startup-error module, the package boundary, the server wiring (validation
  before bind), the compose secret and the Dockerfile shipping, each backed
  by mutation probes; the deterministic probes execute the issue's test plan
  ("start with a missing required field and confirm the error names it") —
  the compiled boundary throws MissingRequiredSettingError naming
  sessionSecret, and booting the committed server without EPPP_SESSION_SECRET
  exits non-zero naming the field while a valid secret boots to /health 200
- health-endpoint/app-readiness boot probes: provide a valid
  EPPP_SESSION_SECRET (the required setting is validated at startup)
- ci.yml: new config-startup-error job (builds config + database-postgres,
  runs the suite); app-readiness job now builds the config package too
- .gitignore: transient .config-startup-probe-*.mjs files

tests/health-endpoint.test.mjs

@@ -116,14 +116,22 @@ function reservePort() {
  * env): since E00-S03-T06 the health endpoint is the readiness probe, and the
  * no-DATABASE_URL path is the one with no startup migration run to wait for —
  * the server reports ready immediately, so this smoke test stays deterministic
- * and exercises exactly the committed no-migration readiness path.
+ * and exercises exactly the committed no-migration readiness path. Since
+ * E00-S04-T02 the required admin-session secret (EPPP_SESSION_SECRET, the
+ * schema's required field) is validated at startup, so the boot provides a
+ * valid one — a missing secret is the field-specific startup-error path
+ * locked in by tests/config-startup-error.test.mjs.
  */
 function bootServer(port) {
   const args =
     tsExecMode() === 'strip-types-flag'
       ? ['--experimental-strip-types', SERVER_SRC]
       : [SERVER_SRC];
-  const env = { ...process.env, PORT: String(port) };
+  const env = {
+    ...process.env,
+    PORT: String(port),
+    EPPP_SESSION_SECRET: 's'.repeat(32),
+  };
   delete env.DATABASE_URL;
   const child = spawn(process.execPath, args, {
     cwd: REPO_ROOT,