refactor(ci): one verify-stack stage for all live-stack checks (closes #58) (refs #46 #56)

On the single self-hosted runner CI jobs run sequentially, so booting OpenZaak once
beats once-per-job. Replace the integration + notifications + compose-smoke jobs with
one verify-stack job that brings the full stack up once and runs, as clearly-named
steps: health (make verify-up, the DoD smoke) → ACL ↔ OpenZaak (verify-acl) →
OpenZaak → NRC delivery (verify-nrc) → teardown (always) + log dump on failure.

The check logic moves into stack-agnostic runners (run-acl-integration.sh,
run-notification-check.sh) that operate on whatever stack is already up, reaching
services by container IP. The local single-concern wrappers (make integration oz-only,
make verify-notifications oz+nrc) keep working by delegating to the same runners, so
nothing is duplicated. make ci now runs the consolidated 'verify' stage.

Verified locally: make verify boots the full stack once, ACL integration passes and
the NRC notification is delivered, then tears down.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/architecture/adr-0006-integration-test-provisioning.md

@@ -46,10 +46,11 @@ itself. No new test dependency is added.**
   `OpenZaakGateway` against it.
 - **The lane is kept out of the fast checks.** `make unit` runs with
   `--filter "Category!=Integration"`; Stryker is pinned to `Acl.Tests` (`test-projects`), so
-  neither the unit nor the mutation lane needs a live stack. A new `make integration` target
-  (`infra/run-integration.sh`) brings the stack up, seeds, runs the lane, and always tears down
-  — mirrored by a Gitea Actions `integration` job. This matches `make` being the single source
-  of truth (ADR-0005).
+  neither the unit nor the mutation lane needs a live stack. A `make integration` target
+  (`infra/run-integration.sh`) brings up a throwaway OpenZaak and runs the lane locally.
+  In CI the check runs as the `verify-acl` step of the consolidated `verify-stack` job
+  (issue #58) — one shared full-stack bring-up. This matches `make` being the single
+  source of truth (ADR-0005).
 - **Publishing is opt-in in the seed.** `infra/openzaak/seed_catalogus.py` gains an
   `OZ_PUBLISH=1` path that adds the relations OpenZaak's publish requires — two statustypen
   (begin/eind), a roltype, and a resultaattype whose Selectielijst procestype is matched onto

docs/architecture/adr-0007-notification-wiring.md

@@ -41,11 +41,12 @@ existing `big-reference-seed` client, and run NRC's celery-beat so deliveries ha
   S-01 stack dropped beat — so notifications were accepted but never delivered. An
   `nrc-beat` service is added to every compose; the interval is lowered to 5s.
 
-Verification is a runner-safe smoke (`make verify-notifications`,
-`infra/verify-notifications.sh` + a `notifications` CI job): it brings the stack up,
-seeds a published BIG zaaktype, registers an abonnement to a webhook sink, creates a
-zaak, and asserts the sink receives the `zaken`/`create` notification — all from
-containers **inside** the compose network (ADR-0006).
+Verification is a runner-safe smoke (`infra/run-notification-check.sh`): it seeds a
+published BIG zaaktype, registers an abonnement to a webhook sink, creates a zaak, and
+asserts the sink receives the `zaken`/`create` notification — all from containers
+**inside** the compose network (ADR-0006). Locally it runs via `make verify-notifications`
+(a throwaway oz+nrc stack); in CI it runs as the `verify-nrc` step of the consolidated
+`verify-stack` job (one shared full-stack bring-up — issue #58).
 
 ## Consequences
 

docs/runbooks/ci.md

@@ -17,20 +17,21 @@ and CI cannot drift:
 | `build` | `make build` → `dotnet build … -c Release` | .NET 10 SDK |
 | `unit` | `make unit` → `dotnet test … -c Release --filter "Category!=Integration"` | .NET 10 SDK |
 | `mutation` | `make mutation` → `dotnet tool restore` → `dotnet stryker` (ACL); uploads the HTML report as an artifact | .NET 10 SDK |
-| `integration` | `make integration` → `infra/run-integration.sh`: OpenZaak up → seed a **published** BIG zaaktype + run `Acl.IntegrationTests` **as containers inside the compose network** → tear down | container engine + egress (base images, nuget, `selectielijst.openzaak.nl`) |
-| `notifications` | `make verify-notifications` → bring up OpenZaak + NRC → seed → assert a zaak-create notification reaches a subscriber (containers on the network) → tear down | container engine + egress (base images, `selectielijst.openzaak.nl`) |
-| `compose-smoke` | `make smoke` → seed config volumes → `up -d` (full stack) → `up --wait` durable services → `down` | container engine + compose v2 |
+| `verify-stack` | the single live-stack stage — steps: `make verify-up` (full stack up + health, the DoD smoke) → `make verify-acl` (ACL ↔ OpenZaak) → `make verify-nrc` (OpenZaak → NRC delivery) → `make down` | container engine + egress (base images, nuget, `selectielijst.openzaak.nl`) |
 
-> **The `integration` job needs no `setup-dotnet`.** dotnet runs inside the test
-> image, and both the seed and the test join the OpenZaak network and reach it by
-> container IP — so the runner never has to reach a published port
-> (see [gitea-actions-gotchas.md §5](gitea-actions-gotchas.md)).
+> **Why one `verify-stack` job, not three.** The single self-hosted runner runs jobs
+> **sequentially**, so booting OpenZaak once (instead of once per check) is the
+> cheapest layout (issue #58). It subsumes the old `integration`, `notifications`, and
+> `compose-smoke` jobs — the bring-up step *is* the "compose up reaches green health"
+> gate. No `setup-dotnet`: the ACL test runs in a built image and every check reaches
+> services by **container IP** (the runner can't reach published ports — see
+> [gitea-actions-gotchas.md §5/§6](gitea-actions-gotchas.md)).
 
 All `uses:` references are absolute, tag-pinned URLs (`https://github.com/actions/checkout@v4`,
 `https://github.com/actions/setup-dotnet@v4`) per CLAUDE.md §8.7 and §15 — Gitea
 Actions resolves them from GitHub.
 
-> **`compose-smoke` runs on a containerized runner.** Workspace bind mounts do
+> **`verify-stack` runs on a containerized runner.** Workspace bind mounts do
 > **not** reach the sibling containers Compose starts, so config/assets are
 > streamed into external named volumes via `docker cp` (`infra/seed-config.sh`),
 > and the upstream images are used verbatim (no build). If you add a service that
@@ -92,19 +93,23 @@ the containerized CI runner). Keep the two files in sync.
 
 ## Running CI locally (`make ci`)
 
-Until the runner exists, run the full pipeline yourself before pushing:
+`make ci` runs the exact same checks as the pipeline — handy to run before pushing:
 
 ```bash
-make ci          # lint + build + unit + mutation + smoke — the fast pipeline lanes
+make ci          # lint + build + unit + mutation + verify — mirrors the pipeline
 make lint        # or a single stage
 make mutation    # Stryker.NET ratchet on the ACL
-make smoke       # compose up --wait, curl /health, tear down
-make integration # ACL ↔ real OpenZaak (its own CI job; not part of `make ci`)
+make verify      # the live-stack stage: full stack up once → ACL + NRC checks → down
 ```
 
-> `make integration` is a separate, heavier lane (it stands the OpenZaak stack up and
-> seeds a published zaaktype), so it is **not** folded into `make ci`. Run it before
-> pushing changes that touch the ACL gateway or the OpenZaak seed. See ADR-0006.
+> **`make verify`** mirrors the CI `verify-stack` job: it boots the full stack once and
+> runs both the ACL ↔ OpenZaak and OpenZaak → NRC checks against it. For fast,
+> single-concern local iteration use a lighter throwaway stack instead:
+>
+> ```bash
+> make integration          # ACL ↔ OpenZaak only (no NRC)
+> make verify-notifications # OpenZaak → NRC delivery only
+> ```
 
 **Prerequisites:** .NET 10 SDK, a container engine with Compose v2, and `curl`.
 

docs/runbooks/gitea-actions-gotchas.md

@@ -173,7 +173,7 @@ reality is a service name or an IPv4 literal — and only the IP passes.
 **Fix** — in-network tooling reaches OpenZaak/NRC by **container IP**
 (`docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}'`), not
 service name; the notif verify harness also registers the sink callback by IP.
-(`infra/run-integration.sh`, `infra/verify-notifications.sh`.)
+(`infra/run-acl-integration.sh`, `infra/run-notification-check.sh`.)
 
 **Related — abonnement callbacks must enforce auth.** NRC probes a callback when an
 abonnement is registered and refuses it (`no-auth-on-callback-url`) unless it returns