…li#515 release) (#549)

# Motivation

This reverts the CI churn from this debugging session (#538 + #547) back
to the pre-shitshow baseline. The production satellite was shipping with
**no custom query methods** (sign-in failed with `IC0536 — Canister has
no query method 'app_get_profile'`). After a long misdiagnosis on my
side (bindgen, then missing `ic-wasm`/`candid-extractor`), the Juno
author found the real cause: a **juno CLI bug** — the generated Rust
custom-functions module was not included in the `wasm32-wasip1`
satellite build. Fixed upstream in
[junobuild/cli#515](junobuild/cli#515). Nothing
in our workflows was the cause, so the changes I made (bare pinned-CLI
build, auto-upgrade disable) are no longer warranted once the upstream
fix ships.

# Changes

Revert #538 — `upgrade.yml` and `publish.yml` build/upgrade/publish go
back to `junobuild/juno-action@full`.
Revert #547 — restore the `push: branches: [main]` trigger on
`upgrade.yml`.
Revert the `docs/ai/pr-and-ci.md` edits from #538 (which also removes
the incorrect "bindgen → `service : {}`" rationale).
The staged result is byte-identical to `main` immediately before #538.

# Tests

YAML-validated and prettier-checked. **DRAFT — do not merge yet.** Merge
only after: (1) `@junobuild/cli > 0.15.4` (with cli#515) is released,
(2) `junobuild/juno-action` is rebuilt on it, and (3) a manual
`workflow_dispatch` upgrade is confirmed to build a satellite that
exposes `app_get_profile`. Until then, auto-upgrade stays off (current
`main` state) and the satellite is upgraded locally.

# Motivation

The CI satellite build was shipping with no custom query methods
(`IC0536 — Canister has no query method 'app_get_profile'`), breaking
production sign-in. Root cause was a juno CLI bug — the generated Rust
custom-functions module was not included in the `wasm32-wasip1`
satellite build. Fixed upstream in
[junobuild/cli#515](junobuild/cli#515), released
in **`@junobuild/cli@0.15.5`**.

# Changes

Bump the two **direct** CLI pins from `0.15.4` → `0.15.5`: `checks.yml`
(`satellite-schema`) and `e2e.yml`.

The action-based workflows need no change — `upgrade.yml`/`publish.yml`
use `junobuild/juno-action@full`, which now resolves to image `0.7.4`
bundling cli `0.15.5`
([junobuild/juno-action#110](junobuild/juno-action#110)),
so they already pick up the fix.

# Tests

The `e2e` job on this PR is the field test: with `0.15.5` the satellite
build now embeds the custom functions, so the signed-in flows (`auth`,
`homepage`, signed-in `navigation`) that were failing with
`getProfile()` errors should pass. Note: a separate, pre-existing `[404]
GET /social` routing failure and the 45-min e2e timeout are tracked
elsewhere (`fix/e2e-bounded-networkidle-and-timeout`) and are out of
scope here. `satellite-schema` should stay green (and now actually
regenerates against the fixed build).

Follow-up (not in this PR): `checks.yml`'s inline comment above the
install still references the old (incorrect) "bindgen → `service : {}`"
rationale and could be trimmed; left untouched here to keep the diff to
the version bump.