The caddy-validate step added for #26 (and merged to main via #29) used a `-v "$PWD":/workspace` bind mount, which does not propagate to the sibling Docker daemon in the Gitea act runner — the container saw an empty dir and every PR failed with "open Caddyfile: no such file or directory". Validate instead inside the freshly built image, where the production Caddyfile lives at /etc/caddy/Caddyfile: no bind mount, and it checks the exact file that ships. Caddyfile.test keeps being covered by the homepage smoke test (its container must serve 200). Closes #26 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>