ci: add clean-install job (no pip cache)

.github/workflows/ci.yml

@@ -75,6 +75,32 @@ jobs:
       - name: Pytest
         run: pytest -v
 
+  # Proves requirements.txt/requirements-dev.txt install cleanly with no
+  # pip cache — `static`/`test` above cache pip for CI speed, but a cache
+  # hit can mask a genuinely broken pin (a version that no longer exists,
+  # a dependency conflict only visible on a cold resolve). `docker-build`
+  # below also installs from a cold image, but that's a side effect of
+  # proving the deploy artifact builds, not a declared clean-install check
+  # in its own right — this job is that check.
+  clean-install:
+    name: Clean install (no cache)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies (cold)
+        run: |
+          pip install --no-cache-dir --upgrade pip
+          pip install --no-cache-dir -r requirements.txt -r requirements-dev.txt
+
+      - name: Smoke test import
+        run: python -c "import agent, web; print('ok')"
+
   # Proves the actual production artifact builds — the Dockerfile is what
   # deploys (Coolify), and until this job existed nothing in CI verified
   # it still builds after a change. Build only, never pushed anywhere.