ci: verify the CLI-only package installs and ships no GUI binary

install.sh checks gpgui-helper --version unconditionally and its
GPGUI_INSTALLED knob doesn't cover the helper, so it cannot validate
a BUILD_GUI_HELPER=0 package. Assert the variant's actual contract
instead: the three CLI binaries run, and neither GUI binary shipped.

Author: Ronald Hötschl

.github/workflows/build.yaml

@@ -222,6 +222,30 @@ jobs:
           -e BUILD_WEBVIEW_AUTH=0 \
           -v $(pwd)/build-gp-cli-${{ matrix.package }}:/workspace \
           yuezk/gpdev:${{ matrix.package }}-builder-tauri2
+    # Not `bash install.sh`: that script checks `gpgui-helper --version`
+    # unconditionally, and BUILD_GUI_HELPER=0 means it isn't built. Its
+    # GPGUI_INSTALLED knob covers gpgui but not the helper. Rather than ask for
+    # a new knob in the builder image, this asserts the property that actually
+    # matters for the variant — the CLI binaries work and no GUI binary shipped.
+    - name: Verify CLI-only ${{ matrix.package }} package in Docker
+      run: |
+        docker run --rm \
+          -e COREPACK_INTEGRITY_KEYS=0 \
+          -v $(pwd)/build-gp-cli-${{ matrix.package }}:/workspace \
+          --entrypoint /bin/bash \
+          yuezk/gpdev:${{ matrix.package }}-builder-tauri2 -lc '
+            set -eux
+            if command -v apk >/dev/null; then
+              sudo apk add --allow-untrusted /workspace/artifacts/*.apk
+            else
+              sudo apt-get install -y /workspace/artifacts/*.deb
+            fi
+            gpclient --version
+            gpservice --version
+            gpauth --version
+            ! command -v gpgui-helper
+            ! command -v gpgui
+          '
     - name: Upload CLI-only ${{ matrix.package }} package
       uses: actions/upload-artifact@v7
       with: