fix(ci): install ripgrep on runner before qa-required scripts

CSS/docs/JS contract checks call rg directly on the host runner,
not inside Docker, so ripgrep must be present on the ubuntu runner.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/qa-required.yaml

@@ -32,5 +32,8 @@ jobs:
       - name: Run DB migrations
         run: docker compose exec -T php php bin/console db:migrate
 
+      - name: Install ripgrep
+        run: sudo apt-get install -y ripgrep
+
       - name: Run required QA gates
         run: bin/qa-required.sh