ci(acl): run the ACL integration test in CI inside the compose network (closes #55) (refs #46)

The hosted runner can't reach the stack's published ports (sibling containers),
so run the seed and the test as containers joined to the OpenZaak network,
reaching it by container IP — a single-label host like 'openzaak' isn't URL-valid
for OpenZaak's own URLValidator, but an IPv4 literal is. Code is delivered via
image build / docker cp (bind mounts don't reach the daemon either).

- infra/run-integration.sh: up -> wait healthy (docker inspect) -> seed published
  zaaktype (python container on the net) -> build + run the test image on the net
  -> always tear down. Plain docker primitives only (portable docker/podman).
- services/acl/Dockerfile.integration: builds + runs Acl.IntegrationTests; dotnet
  lives in the image, so the CI job needs only Docker (no setup-dotnet).
- make integration now delegates to the script; re-added the Gitea Actions job.

Supersedes the local-only gap documented earlier; #55 is no longer needed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/runbooks/ci.md

@@ -17,13 +17,13 @@ and CI cannot drift:
 | `build` | `make build` → `dotnet build … -c Release` | .NET 10 SDK |
 | `unit` | `make unit` → `dotnet test … -c Release --filter "Category!=Integration"` | .NET 10 SDK |
 | `mutation` | `make mutation` → `dotnet tool restore` → `dotnet stryker` (ACL); uploads the HTML report as an artifact | .NET 10 SDK |
+| `integration` | `make integration` → `infra/run-integration.sh`: OpenZaak up → seed a **published** BIG zaaktype + run `Acl.IntegrationTests` **as containers inside the compose network** → tear down | container engine + egress (base images, nuget, `selectielijst.openzaak.nl`) |
 | `compose-smoke` | `make smoke` → seed config volumes → `up -d` (full stack) → `up --wait` durable services → `down` | container engine + compose v2 |
 
-> **`make integration` is not a hosted-runner job yet.** The ACL ↔ real-OpenZaak
-> test (`make integration`, ADR-0006) passes locally and on a host-executing runner,
-> but a process on the hosted runner can't reach the stack's published ports
-> (sibling containers — see [gitea-actions-gotchas.md §5](gitea-actions-gotchas.md)).
-> Run it inside the compose network to gate it in CI — tracked in **#55**.
+> **The `integration` job needs no `setup-dotnet`.** dotnet runs inside the test
+> image, and both the seed and the test join the OpenZaak network and reach it by
+> container IP — so the runner never has to reach a published port
+> (see [gitea-actions-gotchas.md §5](gitea-actions-gotchas.md)).
 
 All `uses:` references are absolute, tag-pinned URLs (`https://github.com/actions/checkout@v4`,
 `https://github.com/actions/setup-dotnet@v4`) per CLAUDE.md §8.7 and §15 — Gitea

docs/runbooks/gitea-actions-gotchas.md

@@ -152,6 +152,8 @@ service by name (`http://openzaak:8000`). For a test/seed that needs the repo's
 code, deliver it via a **built image** (not a bind mount — §1), then
 `docker run --network <stack>_cg …`.
 
-**Status** — `make integration` (the ACL ↔ real-OpenZaak test, ADR-0006) therefore
-runs locally / on a host-executing runner only. Gating it on the hosted runner via
-the compose network is tracked in **#55**.
+**Applied** — `make integration` (the ACL ↔ real-OpenZaak test, ADR-0006) does
+exactly this: `infra/run-integration.sh` runs the seed and the test as containers on
+the OpenZaak network and reaches it by **container IP** (a single-label service name
+like `openzaak` isn't URL-valid — OpenZaak echoes the request host into the URLs it
+returns and then rejects them with Django's `URLValidator`; an IPv4 literal passes).