build(deploy): run pnpm boundaries in the image build stage

A module that imports a package at run time without declaring it a
production dependency now fails the image build instead of the API's
startup, since the runtime receives production dependencies only.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

deploy/Dockerfile

@@ -54,10 +54,12 @@ FROM toolchain AS build
 COPY . .
 RUN --mount=type=cache,id=ekklesia-pnpm-store,target=/pnpm/store \
     pnpm install --frozen-lockfile --store-dir /pnpm/store
-# The same gates `pnpm verify` runs for modules and migrations, against exactly the module set in this
-# context. Each script builds first; the final build is a Turbo cache hit that keeps the intent
-# explicit.
-RUN pnpm modules:validate && pnpm migrations:validate && pnpm build
+# The same gates `pnpm verify` runs for boundaries, modules, and migrations, against exactly the
+# module set in this context. `pnpm boundaries` comes first and reads only sources: among its rules,
+# a module that imports something at run time without declaring it a production dependency fails
+# here, because the production-only install below would leave it unresolvable at API startup. Each
+# validate script builds first; the final build is a Turbo cache hit that keeps the intent explicit.
+RUN pnpm boundaries && pnpm modules:validate && pnpm migrations:validate && pnpm build
 # What the runtime resolves at startup, at the paths it resolves them from:
 #   - every workspace package's `dist/` (every package exports only from `dist/`), which includes
 #     the Dashboard and display host assets under `surfaces/shell/dist/browser/`;