feat(settings): expose agent-accessible settings (#3543)

.github/workflows/backend-tests.yml

@@ -84,6 +84,9 @@ jobs:
         env:
           PATTERNS: |
             apps/backend/**
+            apps/web/lib/settings-discovery/contract.generated.json
+            apps/web/lib/settings-discovery/profile-contract.generated.json
+            scripts/settings-contract-ci.test.mjs
             # check-make-shells also lints the root Makefile's $(shell ...)
             # probes, so a change there has to be able to trip it.
             Makefile
@@ -178,6 +181,10 @@ jobs:
       - name: Build
         run: go build -v ./cmd/kandev
 
+      - name: Verify settings catalog contract
+        working-directory: ${{ github.workspace }}
+        run: node --test scripts/settings-contract-ci.test.mjs
+
       - name: Check required-store SQL portability
         run: go run ./cmd/sqlguard ./internal
 

.github/workflows/frontend-tests.yml

@@ -87,6 +87,7 @@ jobs:
             apps/prettier.config.mjs
             apps/.prettierignore
             apps/web/**
+            scripts/settings-contract-ci.test.mjs
             apps/packages/**
             apps/pnpm-lock.yaml
             apps/backend/go.mod
@@ -168,6 +169,10 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Verify settings catalog contract
+        working-directory: ${{ github.workspace }}
+        run: node --test scripts/settings-contract-ci.test.mjs
+
       - name: Regenerate OSS licenses manifest
         run: pnpm --filter @kandev/web licenses:gen