Keep the light client out of the bot images

@pezkuwi/rpc-provider lists @bizinikiwi/connect as an optional dependency,
so npm installed it, with smoldot, into both images. Both are GPL-3.0, and
the bots never load them: they reach the chains over WsProvider. The images
now install with --omit=optional; with that install both bots load and read
the relay, Asset Hub and People chains.

The lockfiles still list the packages, so Dependency Review, which denies
GPL-3.0, flagged them on the new payout-bot lockfile (the noter's had them
before). It allows exactly those three packages, and the bots job fails if
an image contains @bizinikiwi or smoldot, so the allowance cannot outlive
the reason for it.

.github/workflows/ci.yml

@@ -37,6 +37,7 @@ jobs:
   # with every key type, and the bot must load its whole module graph and stop
   # only where it reads the mnemonic that CI does not have.
   bots:
+    name: bots (${{ matrix.bot }})
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -56,6 +57,13 @@ jobs:
       - name: Build the image
         run: docker build -t bot ${{ matrix.bot }}
 
+      # Dependency Review allows these GPL-3.0 packages in the lockfiles only
+      # because no image installs them; this is the check that keeps it true.
+      - name: No light client in the image
+        run: |
+          docker run --rm bot sh -c '! [ -e node_modules/@bizinikiwi ] && ! [ -e node_modules/smoldot ]' || {
+            echo "the image installs the light client; it must be built with --omit=optional"; exit 1; }
+
       - name: Crypto stack
         run: docker run --rm -v "$PWD/scripts/bot-smoke.mjs:/app/bot-smoke.mjs:ro" bot node bot-smoke.mjs ${{ matrix.mode }}