fix(infra): portable health poll instead of compose --wait (refs #30)

`make smoke` errored locally because podman-compose doesn't implement
`docker compose up --wait` (`unrecognized arguments: --wait`).

Replace the `--wait` step with infra/wait-healthy.sh, which polls each durable
health-checked service ($(WAIT_SVCS)) via `docker ps` + `docker inspect
'{{.State.Health.Status}}'`. This:

- works on both docker compose (CI) and podman-compose (local) — only plain
  docker primitives, no `--wait`;
- reads the in-container healthcheck, so it needs no host port access (the CI
  runner can't reach published ports);
- ignores the one-shot init jobs, sidestepping the "--wait fails when a
  consumer-less one-shot exits 0" issue (flowable-init).

Verified on podman-compose: wait-healthy.sh reports bff healthy (rc=0); podman
exposes .State.Health.Status (starting -> healthy) and the name filter matches
both `_` and `-` container naming.

Docs: gitea-actions-gotchas.md updated (the two `--wait` sections folded into one
"portable health poll" section).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/runbooks/gitea-actions-gotchas.md

@@ -83,36 +83,26 @@ seeds then starts. CI uses `make smoke`, which does the same.
 No bind mounts of these config files remain, so the SELinux `:z`/`:Z` relabel flag
 is no longer needed anywhere in `infra/` (named volumes don't need relabeling).
 
-## `--wait` fails on one-shot containers with no dependant
+## Readiness: a portable health poll, not `docker compose up --wait`
 
-`docker compose up --wait` treats a service that **exits** as a failure of the
-"stay up" condition — **unless** another service depends on it with
-`condition: service_completed_successfully`. Our init jobs `oz-init` and
-`nrc-init` are fine (`openzaak`/`nrc-web` depend on their completion), but
-`flowable-init` deploys the BPMN and exits 0 with **no dependant**, so a
-whole-project `--wait` fails the moment it exits — even with everything else
-healthy. The symptom is a `compose-smoke` failure whose last compose line is:
+The smoke does **not** use `docker compose up --wait`, for three reasons:
 
-```
-container infra-flowable-init-1 exited (0)
-```
+- **podman-compose doesn't implement `--wait`** (`unrecognized arguments:
+  --wait`), so it would break local dev.
+- A whole-project `--wait` **fails when a one-shot with no
+  `service_completed_successfully` dependant exits** — `flowable-init` deploys
+  the BPMN and exits 0, which `--wait` treats as the project failing (symptom:
+  last compose line `container infra-flowable-init-1 exited (0)`).
+- The containerized CI runner **can't reach published host ports**, so an
+  external `curl localhost:8080/health` doesn't work either.
 
-**Fix.** The smoke does **not** `--wait` on the whole project. It starts
-everything with `up -d`, then `up -d --wait <services>` only for the durable,
-health-checked services (`openzaak nrc-web acl bff` — see `WAIT_SVCS` in the
-`Makefile`). One-shots still run (and deploy), they just don't gate `--wait`.
-
-This also removed the old external `curl http://localhost:8080/health` check:
-the CI job runs in a container and **can't reach published host ports** at
-`localhost`, and the per-service healthchecks (which run *inside* the
-containers) already prove readiness, so `--wait` succeeding *is* the smoke.
-
-## `--wait` needs an explicit timeout
-
-`docker compose up --wait` defaults to a 60-second timeout in some Compose v2
-releases. A cold OpenZaak migrate alone takes ~50 s, so the smoke target passes
-`--wait-timeout 300` (see `Makefile`). The 3-minute Definition-of-Done budget
-still holds — this just stops `--wait` giving up before the stack is healthy.
+**Fix.** `infra/wait-healthy.sh` polls each durable, health-checked service
+(`openzaak nrc-web acl bff` — `WAIT_SVCS` in the `Makefile`) with `docker ps` +
+`docker inspect '{{.State.Health.Status}}'`, waiting for `healthy`. That uses
+only primitives both docker compose and podman-compose support, reads the
+in-container healthcheck (no host port needed), and ignores the one-shots (they
+only need to have run). `WAIT_TIMEOUT` (default 420 s) covers the cold
+OpenZaak migrate (~90 s) plus app start.
 
 ## PostGIS readiness vs. `pg_isready`