fix(ci): ship serve-web.ts's import into the web runtime image

[tyler-dane]

What and why

Every Release on main run since #3815 has failed its staging health check with service web is not running: web restarting, on both staging-cloud and staging-selfhosted (latest run).

#3815 gave self-host/serve-web.ts its first import: the COMPRESSIBLE_STATIC_TYPES map it shares with build.ts's precompress writer. Both web Dockerfiles copy named files into their runtime stage rather than the tree, and neither copies that file, so bun self-host/serve-web.ts exits with error: Cannot find module '../packages/web/compressible-static-types' before Bun.serve is reached. The image builds green and the container restart-loops. Reproduced by running serve-web.ts against a directory holding only the files the runtime stage copies; verified that the same layout plus the map boots and answers 200 on / and /index.html.

Both Dockerfiles now copy the map alongside the server.

The guard goes in check-agent-constraints rather than next to the Dockerfiles: self-host/*.test.ts is matched by no test:* scan root and by no test-unit.yml step, so nothing in that directory runs in CI, which is why this shipped past a green build. The new runtime-copy rule resolves each relative import in serve-web.ts and requires a matching runtime-stage COPY in both web Dockerfiles, so bun lint fails the next one too.

Two things this deliberately does not touch, both reported in the session rather than fixed here:

• Performance budget is separately red on main: desktop script transfer is 1,068,905 bytes against the 1,060,000 budget. That is a real accumulated regression, and [agent] performance v1 WP-14: drop zod locales, devtools, rrule, bson from boot #3766 is the work that removes ~100 KB from the boot path. Raising the budget to go green would weaken the gate, so it is left alone.
• self-host/docker-compose.test.ts has a stale assertion (expect(workflow).not.toContain("base64") now trips on an unrelated openssl rand -base64 32 help string). It fails on clean main today but is invisible because CI never runs the file. Wiring that directory into CI is a larger change than this hotfix should carry.

Verify

Selected packages: scripts
Checks run: test:scripts:fast, type-check, lint, knip
VERDICT: PASS

🤖 Generated with Claude Code

https://claude.ai/code/session_01YKNwtBmST6KpA4seeJGiSC

---

Generated by Claude Code