docs(backlog): WP-30 done — confirmed GREEN on a real Gitea run

The watched push came back all-green after ebf1f8f (the non-root Dockerfile
fix semgrep's live run caught). Marks the entire showcase/ZGW backlog
(WP-05..54) done.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/project/backlog/WP-30-ci-perf-followups.md

@@ -1,7 +1,6 @@
 # WP-30 — CI performance follow-ups
 
-Status: in-progress (5 of 6 items implemented + committed; pending a real Gitea run to confirm —
-see "Status update" below)
+Status: done (items 1, 3, 4, 5, 6; item 2 deliberately deferred — see "Status update" below)
 Phase: follow-on · CI/infra
 
 ## Why
@@ -71,15 +70,21 @@ act_runner admin access (unconfirmed), and the repo-only partial (`node:24-slim`
 `node:24-bookworm` + memory-cap container (verified against a real OOM risk). Revisit once
 act_runner access is confirmed.
 
-**Cannot self-certify GREEN**: per this WP's own constraint, CI timing/behavior isn't
-observable from the agent's environment. Everything above was checked as far as locally
-possible (YAML parse, `actionlint` 0 issues, `npm run ci`, a real `docker build`) but the actual
-speedup and the path-filter's interaction with any required-status-check config need a watched
-Gitea run before this WP can be marked fully `done`.
+**Confirmed GREEN on a real Gitea run (2026-07-30, watched by the user).** The push did catch
+one real gap that only a live run could: `backend/Dockerfile` (item 5) predated the item-6
+semgrep triage, so its own `dockerfile.security.missing-user-entrypoint` finding (container
+running as root) was never locally verified — semgrep's `--error` gate correctly failed the
+first push on it. Fixed (`ebf1f8f`): switched to the base image's built-in non-root `app` user
+(`$APP_UID`, uid 1654) with `--chown` on both `COPY` layers so SQLite (WP-22, a relative-path
+connection string resolved against the container's `/app` cwd) can still write
+`bigregister.db`; verified for real (rebuilt, confirmed `whoami` is `app`, hit a live
+`GET /brief/preview`, confirmed the db file's actual ownership) before repushing. That run came
+back all-green — path-filtering, the node_modules cache, and the split lint job all behave as
+designed on the real runner.
 
 ## Acceptance criteria
 
-- [ ] Each chosen item verified GREEN on a real Gitea run (watched, since it's not observable
+- [x] Each chosen item verified GREEN on a real Gitea run (watched, since it's not observable
       from the agent env), landed as its own revertable commit.
 - [x] `npm run ci` still passes locally after any workflow/script change (confirmed 2026-07-30,
       full run including backend `dotnet test`/`dotnet format` and both drift checks).