ci(nightly): repair five job classes broken by the #649 QA hardening (#695)

Nightly has been red since 07-28; per-PR CI and main are green. Two investigations traced all five failing classes to #649: extended-matrix required AI bundles it never installs (removed), nightly SYSTEM_DEPS drifted from ci.yml (added libreoffice + a doc-binaries composite for pandoc/pdfcpu), the generated-case classifier only skipped ffmpeg (widened to pdfcpu/soffice/pandoc + excluded repo-audit specs from the lean docker image), a settings spec capped loginAttemptLimit and 429-cascaded the serial bucket (restore via API), and type-to-search refused keystrokes under a route announcer's programmatic focus (guard added). A nightly dispatch on the branch confirmed all five classes green.

tests/unit/helpers/generated-harness-contract.test.ts

@@ -70,12 +70,16 @@ describe("generated QA harness contract", () => {
     expect(text).not.toContain("describe.skip(");
   });
 
-  it("the actual nightly extended lane requires installed AI features", () => {
+  it("the nightly extended lane does not require AI features it never installs", () => {
+    // Strict required-AI mode (absence of a bundle is a failure) is only valid
+    // on a host with bundles installed, which is the release-QA fleet. The
+    // extended-matrix lane has no bundle-install step, so requiring them there
+    // 501s every installed-contract case on a bundle-less runner.
     const workflow = readFileSync(join(process.cwd(), ".github/workflows/nightly.yml"), "utf8");
     const extendedLane = workflow.slice(
       workflow.indexOf("  extended-matrix:"),
       workflow.indexOf("  api-fuzz:"),
     );
-    expect(extendedLane).toContain('REQUIRE_AI_FEATURES: "1"');
+    expect(extendedLane).not.toContain("REQUIRE_AI_FEATURES");
   });
 });