feat(admin-config-tool): wire xceadmin into meson + nix build

Reopens the 2026-07-21 design decision to keep xceadmin outside meson.
Standard onboarding consistency (README 3.3 `nix build .#xcecore` and
3.4 `meson compile` working for xceadmin like every other component)
outweighs the earlier concern about meson's single-artifact model not
fitting a multi-file pip install.

- src/xceadmin/meson.build: custom_target() wrapping install+test,
  stamp-file output, build_always_stale (matches this repo's existing
  clean-rebuild-every-invocation convention).
- src/xceadmin/meson-build.sh: out-of-tree pinned install + pytest;
  stages a repo-mirror/ symlink tree so tests' fixed-relative-path
  assumptions (src/configs/, src/schema/, ha/data/) still resolve from
  a copied location, without touching their deliberate fail-loud
  behavior.
- src/meson.build: subdir('xceadmin') under component != 'xcecli'.
- src/tools/xce-build.sh: xceadmin case now delegates to
  `meson compile -C "$BUILD_DIR" xceadmin` instead of its own
  pip/venv implementation, like every other component.

Verified both build paths: meson compile (165/165 passed) and
nix build --option sandbox false .#xcecore_debug (128 passed / 37
skipped — cert-dependent tests correctly skip under nix's
git-tracked-only hermetic source). AppImage bundling (README 3.5)
is explicitly deferred to future work, not part of this change.

src/xceadmin/meson-build.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Meson-driven xceadmin build: install + test out-of-tree, in the meson
+# build directory. Never writes into the live source checkout -- unlike
+# xce-build.sh's separate xceadmin case (editable install, .venv inside
+# src/xceadmin/, meant for fast dev-loop iteration), this path is what
+# `meson compile`/`nix build .#xcecore` actually invoke, and both need
+# the same purity guarantee every other meson subdir here already has.
+#
+# Several tests reach for sibling directories outside xcecommon/xceadmin's
+# own tree via a fixed relative path (src/configs/, src/schema/, ha/data/
+# -- e.g. test_validation.py's REPO_CONFIGS_DIR deliberately fails loud
+# rather than skips if that layout assumption breaks, by design). Rather
+# than touch test code, this script recreates the exact repo layout
+# out-of-tree via symlinks (read-only references, never a write into the
+# real tree) so every one of those relative-path assumptions still
+# resolves correctly from the copied location.
+set -euo pipefail
+
+SOURCE_DIR="$1"    # .../src/xceadmin (meson.current_source_dir())
+BUILD_DIR="$2"     # .../xceadmin (meson.current_build_dir())
+REPO_ROOT="$3"     # real repo root (contains ha/, src/)
+STAMP_FILE="$4"
+
+SRC_DIR="$REPO_ROOT/src"
+
+MIRROR_DIR="$BUILD_DIR/repo-mirror"
+WORK_DIR="$MIRROR_DIR/src/xceadmin"
+VENV_DIR="$BUILD_DIR/.venv"
+
+echo "=== xceadmin (meson): staging out-of-tree repo-layout mirror ==="
+rm -rf "$MIRROR_DIR"
+mkdir -p "$MIRROR_DIR/src"
+ln -s "$REPO_ROOT/ha" "$MIRROR_DIR/ha"
+ln -s "$SRC_DIR/configs" "$MIRROR_DIR/src/configs"
+ln -s "$SRC_DIR/schema" "$MIRROR_DIR/src/schema"
+
+cp -r "$SOURCE_DIR" "$WORK_DIR"
+# Never trust a stray dev-loop artifact from the live checkout (xce-build.sh's
+# own editable-install byproducts, if this happens to be a live checkout and
+# not a nix-sandboxed source copy) -- always start from a clean tree.
+rm -rf "$WORK_DIR/.venv" "$WORK_DIR/build" "$WORK_DIR"/src/*.egg-info \
+       "$WORK_DIR/.pytest_cache" "$WORK_DIR/.ruff_cache" \
+       "$WORK_DIR/src/xcecommon/schema_files"
+find "$WORK_DIR" -name "__pycache__" -type d -prune -exec rm -rf {} +
+
+SCHEMA_DST="$WORK_DIR/src/xcecommon/schema_files"
+echo "=== xceadmin (meson): syncing bundled schemas ==="
+mkdir -p "$SCHEMA_DST/json"
+cp "$SRC_DIR/schema/controller.capnp" "$SCHEMA_DST/controller.capnp"
+cp "$SRC_DIR/schema/c.capnp" "$SCHEMA_DST/c.capnp"
+cp "$SRC_DIR/configs/schema/"*.schema.json "$SCHEMA_DST/json/"
+
+echo "=== xceadmin (meson): pinned install into build-dir venv ==="
+rm -rf "$VENV_DIR"
+python3 -m venv --system-site-packages "$VENV_DIR"
+"$VENV_DIR/bin/pip" install "$WORK_DIR" --quiet
+
+echo "=== xceadmin (meson): running tests ==="
+"$VENV_DIR/bin/python" -m pytest "$WORK_DIR/tests" -v
+
+touch "$STAMP_FILE"
+echo "=== xceadmin (meson): done ==="