ci(acl): keep the integration lane local-only; document the runner gap (refs #46)

The hosted Gitea runner starts the OpenZaak stack as sibling containers via the
host daemon, so a process on the runner can't reach the published ports — the seed
and dotnet test get Connection refused on localhost:8000. Drop the (non-working)
integration CI job; make integration stays the local / host-runner gate. Document
the limitation in gitea-actions-gotchas.md §5 and the CI runbook, and track running
it inside the compose network in #55. ADR-0006 updated accordingly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -63,24 +63,11 @@ jobs:
           path: services/acl/StrykerOutput/**/reports/mutation-report.html
           if-no-files-found: warn
 
-  integration:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: https://github.com/actions/checkout@v4
-      - uses: https://github.com/actions/setup-dotnet@v4
-        with:
-          dotnet-version: '10.0.x'
-      # `make integration` brings the OpenZaak stack up, seeds a PUBLISHED BIG
-      # zaaktype (OZ_PUBLISH=1) and runs the Integration-category tests, then tears
-      # down. Needs Docker + python3 (both on ubuntu-latest) and outbound access to
-      # selectielijst.openzaak.nl from the OpenZaak container (see ADR-0006).
-      - run: make integration
-      - name: dump OpenZaak logs on failure
-        if: failure()
-        run: docker compose -f infra/openzaak/docker-compose.yml logs --no-color --tail=80 oz-init openzaak 2>&1 || true
-      - name: tear down on failure
-        if: failure()
-        run: docker compose -f infra/openzaak/docker-compose.yml down --volumes 2>&1 || true
+  # NOTE: there is deliberately no `integration` job here yet. `make integration`
+  # runs the ACL ↔ real-OpenZaak test locally / on a host-executing runner, but on
+  # the hosted runner a process on the runner cannot reach the stack's published
+  # ports (sibling containers — see gitea-actions-gotchas.md §5). Running it inside
+  # the compose network is tracked in #55.
 
   compose-smoke:
     runs-on: ubuntu-latest