ci:local does not run the dashboard vitest suite — green CI proves nothing about the dashboard

[pitimon]

Problem

ci:local — the gate wired into both ci.yml (PR gate) and npm-publish.yml (post-merge test job) — never runs the dashboard's vitest suite.

ci:local = npm run dashboard:build && npm test && validate:copy && validate:ui-hardcode && validate:guardrails && docs:openwiki:check && architecture-guardrails

npm test is node --test test/*.test.js — root tests only. The dashboard's ~296 vitest tests (45 files) run only via npm --prefix dashboard run test, which no workflow and no gate invokes. So component-level React tests are not a merge gate.

Why this bites

dashboard:build (vite) does not resolve undefined JSX identifiers — a bundle builds green even when a page references a deleted symbol. Combined with the missing test step, a green ci:local proves only "vite produced a bundle," not "the dashboard works."

This is not theoretical: on refactor/local-only-remove-cloud (the cloud-removal branch, 18.5k lines deleted from the dashboard) broken dashboard states passed as "verified" twice, caught only by manually clicking through the running app. See the statuspage-link miss fixed in 8ff6f23.

Fix

One line — add the dashboard suite to the ci:local chain in package.json, right after the build:

- "ci:local": "npm run dashboard:build && npm test && ..."
+ "ci:local": "npm run dashboard:build && npm --prefix dashboard run test && npm test && ..."

Because both workflows already run npm ci --prefix dashboard and call npm run ci:local, no workflow YAML change is needed — the single script edit closes the gap for PR gate, post-merge publish gate, and local runs at once.

Verification done

• main dashboard suite is green (296/296, 45 files) — adding it will not break main.
• refactor/local-only-remove-cloud dashboard suite is green (233/233, 36 files) — the change will not block PR refactor: make TokenTracker local-only #72 either.