ci(nightly): repair five job classes broken by the #649 QA hardening (#695)

Nightly has been red since 07-28; per-PR CI and main are green. Two investigations traced all five failing classes to #649: extended-matrix required AI bundles it never installs (removed), nightly SYSTEM_DEPS drifted from ci.yml (added libreoffice + a doc-binaries composite for pandoc/pdfcpu), the generated-case classifier only skipped ffmpeg (widened to pdfcpu/soffice/pandoc + excluded repo-audit specs from the lean docker image), a settings spec capped loginAttemptLimit and 429-cascaded the serial bucket (restore via API), and type-to-search refused keystrokes under a route announcer's programmatic focus (guard added). A nightly dispatch on the branch confirmed all five classes green.

docker/docker-compose.test.yml

@@ -14,7 +14,30 @@ services:
     # skips binary-gated tools (AI models need on-demand bundles, etc.), so it
     # cannot meet the host-calibrated coverage thresholds; coverage stays
     # enforced on host CI where every tool is present.
-    command: ["pnpm", "vitest", "run", "--reporter=verbose"]
+    #
+    # Repo-audit specs are excluded: they audit the git checkout and dev host,
+    # not the running product. Dockerfile.test.dockerignore prunes *.md and
+    # .git, and /tmp is a noexec tmpfs, so in this image they can only report
+    # the build context's own stripping (missing DOCKERHUB.md / CONTRIBUTING.md
+    # / third-party notices, no `git ls-files`, a non-executable fake binary).
+    # Host CI runs all of them on every PR.
+    command:
+      [
+        "pnpm",
+        "vitest",
+        "run",
+        "--reporter=verbose",
+        "--exclude",
+        "**/tests/unit/infra/public-tool-counts.test.ts",
+        "--exclude",
+        "**/tests/unit/infra/lint-coverage.test.ts",
+        "--exclude",
+        "**/tests/unit/infra/docs-dev-ports.test.ts",
+        "--exclude",
+        "**/tests/unit/scripts/check-production-licenses.test.ts",
+        "--exclude",
+        "**/tests/unit/helpers/run-generated-tool.test.ts",
+      ]
     environment:
       - NODE_ENV=test
       - AUTH_ENABLED=true