ci(acl): keep the integration lane local-only; document the runner gap (refs #46)

The hosted Gitea runner starts the OpenZaak stack as sibling containers via the
host daemon, so a process on the runner can't reach the published ports — the seed
and dotnet test get Connection refused on localhost:8000. Drop the (non-working)
integration CI job; make integration stays the local / host-runner gate. Document
the limitation in gitea-actions-gotchas.md §5 and the CI runbook, and track running
it inside the compose network in #55. ADR-0006 updated accordingly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/architecture/adr-0006-integration-test-provisioning.md

@@ -47,8 +47,8 @@ itself. No new test dependency is added.**
 - **The lane is kept out of the fast checks.** `make unit` runs with
   `--filter "Category!=Integration"`; Stryker is pinned to `Acl.Tests` (`test-projects`), so
   neither the unit nor the mutation lane needs a live stack. A new `make integration` target
-  brings the stack up, seeds, runs the lane, and always tears down — mirrored by a Gitea
-  Actions `integration` job. This matches `make` being the single source of truth (ADR-0005).
+  brings the stack up, seeds, runs the lane, and always tears down. This matches `make` being
+  the single source of truth (ADR-0005).
 - **Publishing is opt-in in the seed.** `infra/openzaak/seed_catalogus.py` gains an
   `OZ_PUBLISH=1` path that adds the relations OpenZaak's publish requires — two statustypen
   (begin/eind), a roltype, and a resultaattype whose Selectielijst procestype is matched onto
@@ -69,8 +69,13 @@ itself. No new test dependency is added.**
   `selectielijst.openzaak.nl`. It is a stable public reference API (the same one OpenZaak uses
   in production) but it is a network touchpoint, and a CI environment without egress would need
   a local Selectielijst service or a recorded fixture. `OZ_SELECTIELIJST` overrides the base URL.
-- **Cost:** the lane needs the stack up first; CI runs it as a dedicated job (Docker + dotnet +
-  python3), separate from the fast lanes.
+- **Cost:** the lane needs the stack up first, so it is separate from the fast lanes.
+- **Not yet a hosted-runner job.** `make integration` passes locally and on a host-executing
+  runner, but on Gitea's hosted runner a process *on the runner* cannot reach the stack's
+  published ports — Compose starts sibling containers via the host daemon, so the ports bind to
+  the host, not the runner (gitea-actions-gotchas.md §5, the same split as §1). Running the test
+  and seed *inside* the compose network (via a built image, not bind mounts) to gate it in CI is
+  tracked in **#55**. Until then the lane runs locally and is not a merge gate.
 
 ## Alternatives considered