feat(admin-config-tool): wire xceadmin into meson + nix build

Reopens the 2026-07-21 design decision to keep xceadmin outside meson.
Standard onboarding consistency (README 3.3 `nix build .#xcecore` and
3.4 `meson compile` working for xceadmin like every other component)
outweighs the earlier concern about meson's single-artifact model not
fitting a multi-file pip install.

- src/xceadmin/meson.build: custom_target() wrapping install+test,
  stamp-file output, build_always_stale (matches this repo's existing
  clean-rebuild-every-invocation convention).
- src/xceadmin/meson-build.sh: out-of-tree pinned install + pytest;
  stages a repo-mirror/ symlink tree so tests' fixed-relative-path
  assumptions (src/configs/, src/schema/, ha/data/) still resolve from
  a copied location, without touching their deliberate fail-loud
  behavior.
- src/meson.build: subdir('xceadmin') under component != 'xcecli'.
- src/tools/xce-build.sh: xceadmin case now delegates to
  `meson compile -C "$BUILD_DIR" xceadmin` instead of its own
  pip/venv implementation, like every other component.

Verified both build paths: meson compile (165/165 passed) and
nix build --option sandbox false .#xcecore_debug (128 passed / 37
skipped — cert-dependent tests correctly skip under nix's
git-tracked-only hermetic source). AppImage bundling (README 3.5)
is explicitly deferred to future work, not part of this change.

src/tools/xce-build.sh

@@ -113,41 +113,24 @@ case "$COMPONENT" in
         fi
         ;;
     xceadmin)
-        # Python — no meson, dispatched by this case statement alone (design
-        # review correction: xceadmin is deliberately NOT wired into
-        # src/meson.build/meson.options, see .kiro/specs/admin-config-tool/
-        # design.md, File Structure Plan). Ignores $BUILD_DIR/$MESON_OPTS;
-        # $PROFILE only selects editable vs. pinned pip install below.
-        XCEADMIN_DIR="$SRC_DIR/xceadmin"
-        SCHEMA_DST="$XCEADMIN_DIR/src/xcecommon/schema_files"
-        echo "=== Syncing xceadmin bundled schemas ==="
-        mkdir -p "$SCHEMA_DST/json"
-        cp "$SRC_DIR/schema/controller.capnp" "$SCHEMA_DST/controller.capnp"
-        cp "$SRC_DIR/schema/c.capnp" "$SCHEMA_DST/c.capnp"
-        cp "$SRC_DIR/configs/schema/"*.schema.json "$SCHEMA_DST/json/"
-        cd "$XCEADMIN_DIR"
-        # nix's python3 site-packages lives under the read-only /nix/store,
-        # so `pip install` (editable or pinned) can't target it directly —
-        # it refuses with "externally-managed-environment" (PEP 668). Use a
-        # throwaway venv that inherits the nix-provided pycapnp/pyyaml/
-        # jsonschema/click/pytest (--system-site-packages) so pip only ever
-        # has to install xceadmin itself, never rebuild those from PyPI.
-        # Recreated on every invocation for a clean, reproducible install —
-        # same philosophy as setup_build's `rm -rf "$BUILD_DIR"` above.
-        VENV_DIR="$XCEADMIN_DIR/.venv"
-        rm -rf "$VENV_DIR"
-        python3 -m venv --system-site-packages "$VENV_DIR"
-        if [ "$PROFILE" = "release" ]; then
-            echo "=== Building xceadmin Python package (pinned, non-editable) ==="
-            "$VENV_DIR/bin/pip" install . --quiet
-        else
-            echo "=== Building xceadmin Python package (editable) ==="
-            "$VENV_DIR/bin/pip" install -e . --quiet
-        fi
-        echo "=== Running xceadmin tests ==="
-        "$VENV_DIR/bin/python" -m pytest tests/ -v
-        echo "=== Done: xceadmin (profile=$PROFILE) ==="
-        exit 0
+        # Meson-driven like every other component (src/xceadmin/meson.build,
+        # custom_target wrapping meson-build.sh) -- installs pinned/non-
+        # editable out-of-tree in the meson build dir and runs pytest,
+        # every invocation regardless of $PROFILE (xceadmin's suite is pure
+        # Python, unrelated to the ASAN/release C compiler flags $PROFILE
+        # otherwise controls, and fast enough — ~2s — that always running
+        # it costs nothing). This is a strictly stronger guarantee than the
+        # old editable-install-by-default behavior: every run now exercises
+        # real package-data resolution (bug-1460's class of bug), not just
+        # the `release` profile.
+        #
+        # For fast iterative dev without a full meson reconfigure, xceadmin
+        # can still be built standalone: cd xceadmin && pip install -e .
+        # (or see src/xceadmin/meson-build.sh for the exact out-of-tree
+        # steps this target runs).
+        setup_build
+        echo "=== Building + testing xceadmin (via meson) ==="
+        meson compile -C "$BUILD_DIR" xceadmin
         ;;
     all)
         setup_build