feat(admin-config-tool): wire xceadmin into meson + nix build

Reopens the 2026-07-21 design decision to keep xceadmin outside meson.
Standard onboarding consistency (README 3.3 `nix build .#xcecore` and
3.4 `meson compile` working for xceadmin like every other component)
outweighs the earlier concern about meson's single-artifact model not
fitting a multi-file pip install.

- src/xceadmin/meson.build: custom_target() wrapping install+test,
  stamp-file output, build_always_stale (matches this repo's existing
  clean-rebuild-every-invocation convention).
- src/xceadmin/meson-build.sh: out-of-tree pinned install + pytest;
  stages a repo-mirror/ symlink tree so tests' fixed-relative-path
  assumptions (src/configs/, src/schema/, ha/data/) still resolve from
  a copied location, without touching their deliberate fail-loud
  behavior.
- src/meson.build: subdir('xceadmin') under component != 'xcecli'.
- src/tools/xce-build.sh: xceadmin case now delegates to
  `meson compile -C "$BUILD_DIR" xceadmin` instead of its own
  pip/venv implementation, like every other component.

Verified both build paths: meson compile (165/165 passed) and
nix build --option sandbox false .#xcecore_debug (128 passed / 37
skipped — cert-dependent tests correctly skip under nix's
git-tracked-only hermetic source). AppImage bundling (README 3.5)
is explicitly deferred to future work, not part of this change.

src/xceadmin/meson.build

@@ -0,0 +1,34 @@
+# xceadmin (admin-config-tool): Python package, no C compilation.
+#
+# Unlike every other subdir here, there is no single build artifact for
+# meson/ninja to track -- `pip install` produces a multi-file venv tree.
+# custom_target()'s output is a stamp file representing "install +
+# test succeeded", following the same pattern used to wrap non-native
+# build systems (cargo, npm, etc.) inside meson elsewhere in the
+# ecosystem. The real work happens in meson-build.sh, out-of-tree in
+# this subdir's own build directory -- never writing into the live
+# source checkout, unlike xce-build.sh's separate editable-install
+# fast dev-loop path (`xce-build.sh xceadmin`, still available
+# standalone, but no longer xce-build.sh's OWN xceadmin implementation
+# -- see tools/xce-build.sh, which now just calls this same target).
+
+xceadmin_stamp = custom_target('xceadmin',
+  output: 'xceadmin-build.stamp',
+  # No meaningful per-file `input:` list: meson-build.sh copies the whole
+  # subdir tree regardless, so tracking a subset of .py files would only
+  # give false confidence about staleness detection. build_always_stale
+  # instead matches this project's existing convention (every
+  # xce-build.sh component does `rm -rf "$BUILD_DIR"` and rebuilds clean
+  # on every invocation) rather than relying on ninja's file-mtime cache.
+  command: [
+    find_program('bash'),
+    meson.current_source_dir() / 'meson-build.sh',
+    meson.current_source_dir(),
+    meson.current_build_dir(),
+    meson.current_source_dir() / '..' / '..',  # repo root (contains ha/, src/)
+    '@OUTPUT@',
+  ],
+  build_by_default: true,
+  build_always_stale: true,
+  console: true,
+)