fix: add A2UI bundle step to gateway test build

[arubis]

Hi there — first-time contributor here. We ran into this while working on #62 (the rolldown/sandbox build fix in #63). Happy to adjust anything that doesn't fit your preferences.

Problem

Upstream commit 2dcb2449 ("refactor(test): dedupe gateway and web scaffolding") renamed server.canvas-auth.e2e.test.ts to server.canvas-auth.test.ts. The vitest base config excludes **/*.e2e.test.ts, so this rename brought the canvas-auth test into the gateway vitest suite for the first time.

The test expects a scoped A2UI fetch to return HTTP 200, but gateway-tests-build.sh only ran pnpm install — it never produced a2ui.bundle.js. Without the bundle, the A2UI handler returns 503 ("A2UI assets not found"), causing the test to fail.

Fix

Add the minimal build steps needed to produce the A2UI bundle in the test environment:

1. chmod -R u+w node_modules (required for pnpm rebuild)
2. pnpm rebuild for native deps (same download-blocker pattern as the production build)
3. Rolldown PATH shim (rolldown was removed from direct devDependencies upstream but remains as a transitive dep via rolldown-plugin-dts)
4. pnpm canvas:a2ui:bundle

The STDENV_SETUP check is also moved earlier in the script to match the production build's ordering.

Verification

• Confirmed the canvas-auth test passes at v2026.2.22 (upcoming pin bump in Bump to OpenClaw v2026.2.25, fix rolldown sandbox shim, exclude deleted bird tool #63) with these changes
• Confirmed the change is harmless at the current pin (v2026.2.20) — the bundle is produced but the canvas-auth test is still excluded as .e2e.test.ts at that version

Closes #64

Test plan

• nix build .#checks.x86_64-linux.gateway-tests passes at v2026.2.22 — 54 test files, 553 tests, all green
• nix build .#checks.x86_64-linux.gateway-tests at v2026.2.20 — no regression from this change (pre-existing net.test.ts failure unrelated)

🤖 Generated with Claude Code

[arubis]

Folded into #63 — the two fixes are tightly coupled (the test build fix is only needed because of the pin bump, and the pin bump can't pass CI without the test build fix). Keeping them in one PR avoids a chicken-and-egg CI problem.