ci(acl): run the ACL integration test in CI inside the compose network (closes #55) (refs #46)

The hosted runner can't reach the stack's published ports (sibling containers),
so run the seed and the test as containers joined to the OpenZaak network,
reaching it by container IP — a single-label host like 'openzaak' isn't URL-valid
for OpenZaak's own URLValidator, but an IPv4 literal is. Code is delivered via
image build / docker cp (bind mounts don't reach the daemon either).

- infra/run-integration.sh: up -> wait healthy (docker inspect) -> seed published
  zaaktype (python container on the net) -> build + run the test image on the net
  -> always tear down. Plain docker primitives only (portable docker/podman).
- services/acl/Dockerfile.integration: builds + runs Acl.IntegrationTests; dotnet
  lives in the image, so the CI job needs only Docker (no setup-dotnet).
- make integration now delegates to the script; re-added the Gitea Actions job.

Supersedes the local-only gap documented earlier; #55 is no longer needed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Makefile

@@ -106,20 +106,14 @@ local-down:
 changelog:
 	git-cliff --output CHANGELOG.md
 
-## integration: ACL integration tests against a real OpenZaak (S-04a, #46). Brings
-## the stack up, seeds a PUBLISHED BIG zaaktype (OZ_PUBLISH=1, so OpenZaak accepts a
-## real zaak POST), runs the Integration-category tests, then always tears down.
-## Kept out of `unit`/`mutation` because it needs the live stack. See ADR-0006.
-integration: openzaak-up
-	@bash -c 'set -e; \
-	  for i in $$(seq 1 60); do \
-	    c=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/catalogi/api/v1/ || true); \
-	    [ "$$c" = "200" ] && break; sleep 3; done; echo "OpenZaak ready ($$c)"; \
-	  OZ_PUBLISH=1 python3 infra/openzaak/seed_catalogus.py; \
-	  rc=0; dotnet test $(SLN) -c Release --filter "Category=Integration" || rc=$$?; \
-	  docker compose -f $(OZ_COMPOSE) down --volumes >/dev/null 2>&1 || true; \
-	  docker volume rm -f rr-oz-config >/dev/null 2>&1 || true; \
-	  exit $$rc'
+## integration: ACL integration tests against a real OpenZaak (S-04a, #46). The
+## seed and the test run inside the compose network (reaching http://openzaak:8000),
+## so this works on the hosted CI runner where a runner process can't reach the
+## stack's published ports. Brings the stack up, seeds a PUBLISHED BIG zaaktype,
+## runs the Integration-category tests, then always tears down. Kept out of
+## `unit`/`mutation` because it needs the live stack. See infra/run-integration.sh + ADR-0006.
+integration:
+	bash infra/run-integration.sh
 
 ## openzaak-up: start the OpenZaak stack (migrations run on first start)
 openzaak-up: