Run Component build steps in artifact build (S-002-2..10, S-002-12, S-002-13) #115

Builds part of spec S-002, docs/specs/002-component-build-steps.md (feature issue #86): the acceptance criteria below. Each needs a test that names its id (test_s002_<k>_..., or a proves: S-002-2 comment line).

• S-002-2: artifact build --ref <sha> for that Component produces a tarball containing web/dist/index.html, even though the repository's .gitignore lists web/dist
• S-002-3: The same tarball contains no web/node_modules/ entry and contains every file git ls-files lists at that commit
• S-002-4: The metadata file next to the tarball has spec.build.steps listing both steps' workingDirectory and command in order, and spec.build.tools with the versions node --version and pnpm --version printed, and validates against artifact.schema.json
• S-002-5: When a declared build tool is not on PATH, artifact build exits ARTIFACT_BUILD_FAILED with code artifact_build_tool_missing naming the tool, and no git clone runs
• S-002-6: When a declared build tool prints a version older than its buildTools minimum, artifact build exits ARTIFACT_BUILD_FAILED with code artifact_build_tool_unsupported naming the tool and both versions
• S-002-7: A build step that exits non-zero makes artifact build exit ARTIFACT_BUILD_FAILED with code artifact_build_step_failed naming the step and its exit code, and the output directory holds no new .tar.gz or .json file
• S-002-8: A step that finishes but leaves an artifact.include path missing makes artifact build exit ARTIFACT_BUILD_FAILED with code artifact_include_missing and write no artifact
• S-002-9: A step that prints to stdout leaves the stdout of artifact build a single valid JSON envelope
• S-002-10: A build step sees CI=true and does not see a variable such as HCLOUD_TOKEN set in the controller's environment
• S-002-12: cloudfall deploy of a built release puts web/dist/index.html under <installRoot>/releases/<release>/, and cloudfall rollback to the previous release makes <installRoot>/current/web/dist/ that release's files
• S-002-13: For a Component without build, artifact build packages the same file list as before this change and writes metadata with no spec.build key

Depends on #113