ci(acl): run the ACL integration test in CI inside the compose network (closes #55) (refs #46)

The hosted runner can't reach the stack's published ports (sibling containers),
so run the seed and the test as containers joined to the OpenZaak network,
reaching it by container IP — a single-label host like 'openzaak' isn't URL-valid
for OpenZaak's own URLValidator, but an IPv4 literal is. Code is delivered via
image build / docker cp (bind mounts don't reach the daemon either).

- infra/run-integration.sh: up -> wait healthy (docker inspect) -> seed published
  zaaktype (python container on the net) -> build + run the test image on the net
  -> always tear down. Plain docker primitives only (portable docker/podman).
- services/acl/Dockerfile.integration: builds + runs Acl.IntegrationTests; dotnet
  lives in the image, so the CI job needs only Docker (no setup-dotnet).
- make integration now delegates to the script; re-added the Gitea Actions job.

Supersedes the local-only gap documented earlier; #55 is no longer needed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -63,11 +63,22 @@ jobs:
           path: services/acl/StrykerOutput/**/reports/mutation-report.html
           if-no-files-found: warn
 
-  # NOTE: there is deliberately no `integration` job here yet. `make integration`
-  # runs the ACL ↔ real-OpenZaak test locally / on a host-executing runner, but on
-  # the hosted runner a process on the runner cannot reach the stack's published
-  # ports (sibling containers — see gitea-actions-gotchas.md §5). Running it inside
-  # the compose network is tracked in #55.
+  integration:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+      # No setup-dotnet: `make integration` runs the seed and the test as containers
+      # *inside* the OpenZaak compose network (reaching it by container IP), so dotnet
+      # lives in the test image and the runner needs only Docker. This sidesteps the
+      # runner being unable to reach published ports (gitea-actions-gotchas.md §5).
+      # Needs egress to pull base images + nuget + selectielijst.openzaak.nl.
+      - run: make integration
+      - name: dump OpenZaak logs on failure
+        if: failure()
+        run: docker compose -f infra/openzaak/docker-compose.yml logs --no-color --tail=80 oz-init openzaak 2>&1 || true
+      - name: tear down on failure
+        if: failure()
+        run: docker compose -f infra/openzaak/docker-compose.yml down --volumes 2>&1 || true
 
   compose-smoke:
     runs-on: ubuntu-latest