fix(ci): install web host deps in dev-publish job

The dev-publish job splits build into build:core + build:web-host, but
web/ has its own lockfile and is not an npm workspace. The old 'npm run
build' step self-healed via build-web-if-stale.cjs; the direct
build:web-host call does not, causing 'next: not found'.

Matches the pattern already used in ci.yml.

.github/workflows/pipeline.yml

@@ -45,6 +45,9 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Install web host dependencies
+        run: npm --prefix web ci
+
       - name: Cache Next.js build
         uses: useblacksmith/cache@v5
         with: