docs(backlog): WP-30 done — confirmed GREEN on a real Gitea run

The watched push came back all-green after ebf1f8f (the non-root Dockerfile
fix semgrep's live run caught). Marks the entire showcase/ZGW backlog
(WP-05..54) done.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/project/backlog/README.md

@@ -50,7 +50,7 @@ Gates land before the work they cover; each lint rule lands in the same WP as th
 for its existing violations, so every WP ends green.
 
 | WP                                                     | Title                                                                              | Phase                       | Status |
-| ------------------------------------------------------ | ---------------------------------------------------------------------------------- | --------------------------- | ----------- |
+| ------------------------------------------------------ | ---------------------------------------------------------------------------------- | --------------------------- | ------ |
 | [WP-01](WP-01-axe-ci-gate.md)                          | Axe-on-every-story CI gate                                                         | 0 · gates                   | done   |
 | [WP-02](WP-02-check-tokens.md)                         | Harden `check:tokens` + fix what it catches                                        | 0 · gates                   | done   |
 | [WP-03](WP-03-contracts-purity.md)                     | Boundaries I: contracts purity + ApiClient confinement                             | 0 · gates                   | done   |
@@ -80,7 +80,7 @@ for its existing violations, so every WP ends green.
 | [WP-27](WP-27-brief-ux-layer.md)                       | Brief UX layer (undo/redo, standaardbrief, diff)                                   | 6 · Brief v2                | done   |
 | [WP-28](WP-28-brief-v2-demo-polish.md)                 | Brief v2 demo polish (scenarios, e2e, docs)                                        | 6 · Brief v2                | done   |
 | [WP-29](WP-29-stamdata-beheer-editor.md)               | Stamdata beheer editor (low-code, PR-emitting)                                     | follow-on · ADR-0004        | done   |
-| [WP-30](WP-30-ci-perf-followups.md)                    | CI performance follow-ups (node_modules cache, runner image, path filters)         | follow-on · CI/infra        | in-progress |
+| [WP-30](WP-30-ci-perf-followups.md)                    | CI performance follow-ups (node_modules cache, runner image, path filters)         | follow-on · CI/infra        | done   |
 | [WP-31](WP-31-shared-store-helpers.md)                 | Shared store helpers (ActionState/SaveState, history, debounced-save, RemoteData)  | 7 · refinements             | done   |
 | WP-32                                                  | Undo/redo in the stamdata editor (folded into WP-31 — no separate file)            | 7 · refinements             | done   |
 | [WP-33](WP-33-dev-switchers.md)                        | In-app dev switchers (scenario + role)                                             | 7 · refinements             | done   |

docs/project/backlog/WP-30-ci-perf-followups.md

@@ -1,7 +1,6 @@
 # WP-30 — CI performance follow-ups
 
-Status: in-progress (5 of 6 items implemented + committed; pending a real Gitea run to confirm —
+Status: done (items 1, 3, 4, 5, 6; item 2 deliberately deferred — see "Status update" below)
-see "Status update" below)
 Phase: follow-on · CI/infra
 
 ## Why
@@ -71,15 +70,21 @@ act_runner admin access (unconfirmed), and the repo-only partial (`node:24-slim`
 `node:24-bookworm` + memory-cap container (verified against a real OOM risk). Revisit once
 act_runner access is confirmed.
 
-**Cannot self-certify GREEN**: per this WP's own constraint, CI timing/behavior isn't
+**Confirmed GREEN on a real Gitea run (2026-07-30, watched by the user).** The push did catch
-observable from the agent's environment. Everything above was checked as far as locally
+one real gap that only a live run could: `backend/Dockerfile` (item 5) predated the item-6
-possible (YAML parse, `actionlint` 0 issues, `npm run ci`, a real `docker build`) but the actual
+semgrep triage, so its own `dockerfile.security.missing-user-entrypoint` finding (container
-speedup and the path-filter's interaction with any required-status-check config need a watched
+running as root) was never locally verified — semgrep's `--error` gate correctly failed the
-Gitea run before this WP can be marked fully `done`.
+first push on it. Fixed (`ebf1f8f`): switched to the base image's built-in non-root `app` user
+(`$APP_UID`, uid 1654) with `--chown` on both `COPY` layers so SQLite (WP-22, a relative-path
+connection string resolved against the container's `/app` cwd) can still write
+`bigregister.db`; verified for real (rebuilt, confirmed `whoami` is `app`, hit a live
+`GET /brief/preview`, confirmed the db file's actual ownership) before repushing. That run came
+back all-green — path-filtering, the node_modules cache, and the split lint job all behave as
+designed on the real runner.
 
 ## Acceptance criteria
 
-- [ ] Each chosen item verified GREEN on a real Gitea run (watched, since it's not observable
+- [x] Each chosen item verified GREEN on a real Gitea run (watched, since it's not observable
       from the agent env), landed as its own revertable commit.
 - [x] `npm run ci` still passes locally after any workflow/script change (confirmed 2026-07-30,
       full run including backend `dotnet test`/`dotnet format` and both drift checks).