fix(ci): packaging 步驟不可在每次 push 執行

package-plugin.sh 依 SLUG 解析到 wp-content/plugins 下的固定路徑，打包的是
線上工作副本而非 CI 的 checkout，且會在該目錄跑 composer install --no-dev
→ 每次 push 都會把開發機的 vendor/bin 清掉（本 session 中發生兩次）。

- anti-eav-lint.yml：移除 packaging 步驟，只保留 lint
- ci-package.sh：委派共用腳本後補跑 composer install 還原 dev 依賴

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TbG1keQQ7XBa7qMQY16KCY

.gitea/workflows/anti-eav-lint.yml

@@ -53,14 +53,9 @@ jobs:
             echo "TMDO_HOST not found; skipping anti-eav lint"
           fi
 
-      - name: Packaging audit (10-check)
+      # NOTE: no packaging audit here on purpose.
-        run: |
+      # The shared package-plugin.sh resolves the plugin by SLUG to a fixed path
-          # package-plugin.sh lives in the wp-local-dev tree and is shared by all
+      # under wp-content/plugins — it does NOT package the CI checkout. Running it
-          # custom plugins; its output goes to wp-local-dev/dist/.
+      # from a job therefore rebuilds (and `composer install --no-dev`s) the live
-          PACKAGING_HOST="/var/www/Studio/wp-local-dev"
+      # working copy, wiping the developer's vendor/bin. Packaging belongs to the
-          if [ -d "$PACKAGING_HOST" ]; then
+      # release workflow / a manual run, not to every push.
-            SLUG="2meet-data-optimizer"
-            bash "$PACKAGING_HOST/scripts/package-plugin.sh" "$SLUG"
-          else
-            echo "PACKAGING_HOST not found; skipping packaging audit"
-          fi

scripts/ci-package.sh

@@ -19,11 +19,22 @@ SHARED_DIST="/var/www/Studio/wp-local-dev/dist"
 echo "=== Packaging ${SLUG} v${VERSION} ==="
 
 if [ -f "${SHARED}" ]; then
+    # WARNING: package-plugin.sh resolves the plugin by SLUG to its fixed path
+    # under wp-content/plugins — it packages the live working copy, not this
+    # checkout, and runs `composer install --no-dev` there. Restore the dev
+    # dependencies afterwards so a developer's vendor/bin survives.
     bash "${SHARED}" "${SLUG}"
+
     # Surface the artefact under ./dist too so the release job's `ls dist/*.zip`
     # works regardless of which path produced it.
     mkdir -p dist
     cp "${SHARED_DIST}/${SLUG}-v${VERSION}.zip" "dist/${SLUG}-v${VERSION}.zip"
+
+    if [ -f composer.json ]; then
+        echo "--- Restoring dev dependencies (package-plugin.sh ran --no-dev) ---"
+        composer install --no-interaction --quiet
+    fi
+
     echo "=== Done: dist/${SLUG}-v${VERSION}.zip (via shared package-plugin.sh) ==="
     exit 0
 fi