fix(infra): pin OpenZaak/NRC image tags; add smoke log capture on failure (refs #30)

latest bumped to OpenZaak 1.29.0 (2026-06-18) and open-notificaties
updated (2026-06-22), breaking oz-init in compose-smoke.  Pin all four
compose files to stable patch releases:

  open-zaak:            1.28.2  (was :latest -> 1.29.0)
  open-notificaties:    1.16.1  (was :latest)

Tags are still overridable via OPENZAAK_TAG / OPENNOTIFICATIES_TAG env vars.

Also adds two if: failure() steps to the compose-smoke CI job: one that
dumps the last 100 lines of oz-init / nrc-init / acl / bff logs, and one
that tears the stack down cleanly, so future failures are self-diagnosing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -48,3 +48,9 @@ jobs:
     steps:
       - uses: https://github.com/actions/checkout@v4
       - run: make smoke
+      - name: dump container logs on failure
+        if: failure()
+        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init nrc-init acl bff 2>&1 || true
+      - name: tear down on failure
+        if: failure()
+        run: docker compose -f infra/docker-compose.yml down --volumes 2>&1 || true