test(infra): verify-notifications smoke + CI job for the OZ→NRC path (refs #56)

make verify-notifications brings the stack up, seeds a published BIG zaaktype, and
asserts a zaak-create notification is delivered to a webhook-sink abonnement. The
sink + driver run as containers inside the compose network and reach OpenZaak/NRC by
container IP (the runner can't reach published ports, and a single-label host isn't
URL-valid). The sink enforces a bearer token because NRC refuses an unauthenticated
callback. New 'notifications' Gitea Actions job runs it (Docker-only).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -80,6 +80,22 @@ jobs:
         if: failure()
         run: docker compose -f infra/openzaak/docker-compose.yml down --volumes 2>&1 || true
 
+  notifications:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+      # `make verify-notifications` brings up OpenZaak + NRC, seeds, and asserts a
+      # zaak-create notification is delivered to a subscriber — all via containers on
+      # the compose network (the runner can't reach published ports; §5). Needs only
+      # Docker + egress (base images, selectielijst.openzaak.nl).
+      - run: make verify-notifications
+      - name: dump OpenZaak/NRC logs on failure
+        if: failure()
+        run: docker compose -f infra/openzaak/docker-compose.yml -f infra/opennotificaties/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat 2>&1 || true
+      - name: tear down on failure
+        if: failure()
+        run: docker compose -f infra/openzaak/docker-compose.yml -f infra/opennotificaties/docker-compose.yml down --volumes 2>&1 || true
+
   compose-smoke:
     runs-on: ubuntu-latest
     steps: