refactor(ci): one verify-stack stage for all live-stack checks (closes #58) (refs #46 #56)

On the single self-hosted runner CI jobs run sequentially, so booting OpenZaak once
beats once-per-job. Replace the integration + notifications + compose-smoke jobs with
one verify-stack job that brings the full stack up once and runs, as clearly-named
steps: health (make verify-up, the DoD smoke) → ACL ↔ OpenZaak (verify-acl) →
OpenZaak → NRC delivery (verify-nrc) → teardown (always) + log dump on failure.

The check logic moves into stack-agnostic runners (run-acl-integration.sh,
run-notification-check.sh) that operate on whatever stack is already up, reaching
services by container IP. The local single-concern wrappers (make integration oz-only,
make verify-notifications oz+nrc) keep working by delegating to the same runners, so
nothing is duplicated. make ci now runs the consolidated 'verify' stage.

Verified locally: make verify boots the full stack once, ACL integration passes and
the NRC notification is delivered, then tears down.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/run-integration.sh

@@ -1,21 +1,14 @@
 #!/usr/bin/env bash
 #
-# Run the ACL ↔ real-OpenZaak integration test (S-04a / #46) end to end.
+# Local convenience: run the ACL integration test against a throwaway OpenZaak-only
+# stack (fast iteration on the ACL gateway). Brings OpenZaak up, runs the shared
+# stack-agnostic check (infra/run-acl-integration.sh), then always tears down.
 #
-# Everything that talks to OpenZaak runs *inside* the compose network and reaches
-# it by service name (http://openzaak:8000) — the hosted CI runner can't reach the
-# stack's published ports (sibling containers) and bind mounts don't reach the
-# daemon either (gitea-actions-gotchas.md §1/§5). So we use only plain docker
-# primitives (run / create / cp / build) — portable across docker compose (CI) and
-# podman-compose (local), exactly like infra/seed-config.sh. See ADR-0006.
-#
-# Steps: bring OpenZaak up → wait for it healthy → seed a PUBLISHED BIG zaaktype
-# (a seed container on the network) → build + run the test container on the network
-# → always tear down.
+# CI does not use this — there the full stack is brought up once and the same runner
+# is invoked as a step (see the `verify-stack` job / Makefile `verify-*`). See ADR-0006.
 set -euo pipefail
 
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-root="$(cd "$here/.." && pwd)"
 OZ_COMPOSE="$here/openzaak/docker-compose.yml"
 
 cleanup() {
@@ -29,40 +22,13 @@ bash "$here/seed-config.sh" oz
 docker compose -f "$OZ_COMPOSE" up -d
 
 echo ">> waiting for the OpenZaak API container to be healthy"
-# Match the API container under both docker compose (openzaak-openzaak-1) and
-# podman-compose (openzaak_openzaak_1) naming; the regex excludes oz-db / oz-redis.
-api=""
 for _ in $(seq 1 140); do
-  api="$(docker ps -q --filter 'name=openzaak[-_]openzaak' | head -1)"
-  if [ -n "$api" ]; then
-    status="$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{end}}' "$api" 2>/dev/null || true)"
-    [ "$status" = "healthy" ] && break
+  oz="$(docker ps -q --filter 'name=[-_]openzaak[-_]' | head -1)"
+  if [ -n "$oz" ] && [ "$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{end}}' "$oz" 2>/dev/null || true)" = healthy ]; then
+    break
   fi
   sleep 3
 done
-[ -n "$api" ] || { echo "ERROR: OpenZaak API container never appeared" >&2; exit 1; }
-[ "${status:-}" = "healthy" ] || { echo "ERROR: OpenZaak not healthy (status=${status:-none})" >&2; exit 1; }
+[ -n "${oz:-}" ] || { echo "ERROR: OpenZaak never came up" >&2; exit 1; }
 
-# The network the API container is attached to — joined by the seed + test below.
-net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$api" | head -1)"
-# Reach OpenZaak by container IP, not by the service name. OpenZaak echoes its
-# request Host into the self-referential URLs it returns, then validates those URLs
-# with Django's URLValidator — which rejects a single-label host like `openzaak`
-# ("Voer een geldige URL in") while accepting an IPv4 literal (and `localhost`).
-oz_ip="$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$api")"
-oz_base="http://${oz_ip}:8000"
-echo ">> OpenZaak healthy on network $net at $oz_base"
-
-echo ">> seeding a published BIG zaaktype (OZ_PUBLISH=1, inside the network)"
-sid="$(docker create --network "$net" \
-  -e "OZ_BASE=$oz_base" -e OZ_PUBLISH=1 \
-  python:3-slim python /seed_catalogus.py)"
-docker cp "$here/openzaak/seed_catalogus.py" "$sid:/seed_catalogus.py"
-docker start -a "$sid"
-docker rm -f "$sid" >/dev/null
-
-echo ">> building the integration test image"
-docker build -f "$root/services/acl/Dockerfile.integration" -t rr-acl-integration "$root/services/acl"
-
-echo ">> running the integration tests (inside the network)"
-docker run --rm --network "$net" -e "OZ_BASE=$oz_base" rr-acl-integration
+bash "$here/run-acl-integration.sh"