feat(ci): engine-ci runs the tests via a Fallout TestEngine target

[ChrisonSimtian]

Closes #299.

engine-ci only ran dotnet restore + dotnet build, so a green check meant "it compiles" and nothing more. The engine's 123 tests — idempotency, the nested-userns guard, the rootless posture — had never executed in CI.

Approach

Driven through Fallout, not raw dotnet, so the repo keeps one build entrypoint (ADR-0001) and CI can't drift from what runs locally. That's the same reason power-orchestrator-ci calls ./build.sh TestPowerOrchestrator — which, checked while here, does already run its tests, so the engine was the only gap.

• build/Build.cs — new TestEngine target, DependsOn(CompileEngine). No --no-build: CompileEngine builds the engine project only, not the test project (unlike PowerOrchestrator, where Compile builds the whole solution).
• Zero-tests guard — dotnet test exits 0 when it discovers nothing, so a renamed or moved test project would keep the gate green while testing nothing. The target parses the run total and throws if it's zero. Verified both ways: exit 255 with a filter matching no tests, exit 0 normally.
• engine-ci.yml — runs ./build.sh TestEngine; paths: now also covers Infrastructure/engine.Tests/** (a test-only PR previously didn't trigger CI at all), Infrastructure/schema/** (the catalogue drift-guard test reads it), build/** and global.json.
• Secret change: secrets.PACKAGES_PAT replaces GITHUB_TOKEN — going through Fallout means restoring Fallout.* from the Fallout-build org's GitHub Packages feed, and the default GITHUB_TOKEN cannot read packages across orgs.

The gate caught a real defect on its very first run

A test added in #294 asserted a missing secret using MATE_AUTH_PASSWORD as the example key — and that key became real an hour earlier via #285. Since SecretsEnv.Load(null) deliberately folds in process env vars, the test passed or failed depending on whether the developer had sourced secrets.env.

Fixed to use a sentinel key per the HL<issue>_TEST_* convention already established in ConvergeCoreTests, with a comment explaining why it must never be a realistic name. Local run with secrets.env sourced — the previously-failing condition — is green at 123 tests.

.fallout/build.schema.json regenerates to include TestEngine (and PublishValidator, which had never been captured).

This PR should be gated by the thing it adds — it touches build/**, engine.Tests/** and the workflow, so engine-ci runs on it.

🤖 Generated with Claude Code