fix(client): re-pin @babel/core to 7.29.7 + add production-build CI check

.github/renovate.json

@@ -177,6 +177,11 @@
       "matchPackageNames": ["sphinx"],
       "matchUpdateTypes": ["major"],
       "enabled": false
+    },
+    {
+      "description": "Angular 21's build tooling is not Babel 8 compatible — @babel/core 8.x breaks the production AOT build ('NumericLiterals must be non-negative'). Stay on the patched 7.x (also enforced via the client pnpm override) until Angular supports Babel 8.",
+      "matchPackageNames": ["@babel/core"],
+      "allowedVersions": "<8"
     }
   ]
 }

.github/workflows/test.yml

@@ -45,6 +45,32 @@ jobs:
           with:
               name: Coverage Report Client Tests
               path: client/coverage/client/lcov-report
+    build-client:
+        # Production AOT build — catches breakages (e.g. incompatible transitive
+        # tooling like Babel) that unit tests/lint do NOT surface. This is the
+        # exact build the client Docker image runs, so a broken prod build now
+        # fails the PR instead of only failing at deploy time.
+        runs-on: ubuntu-latest
+        timeout-minutes: 30
+        defaults:
+          run:
+            working-directory: 'client'
+        steps:
+        - uses: actions/checkout@v7
+        - name: Setup pnpm
+          uses: pnpm/action-setup@v6
+          with:
+            version: 11.9.0
+        - name: Setup Node.js
+          uses: actions/setup-node@v6
+          with:
+            node-version-file: client/.nvmrc
+            cache: 'pnpm'
+            cache-dependency-path: client/pnpm-lock.yaml
+        - name: Install Dependencies
+          run: pnpm install --frozen-lockfile
+        - name: Build client (production)
+          run: pnpm run build --configuration production
     server-tests:
         runs-on: ubuntu-latest
         timeout-minutes: 60