build(infra): run ClamAV in compose and on the cluster (closes #191) (#193)

Runs a ClamAV daemon (clamav/clamav:1.4.6) in both compose stacks and the Helm chart, health-gated, with a verify-clamav check (EICAR found, clean OK) in verify-stack. ADR-0036 records the scan-in-domain, fail-closed decision (#190).

closes #191

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -248,6 +248,9 @@ jobs:
       - name: RegisterRecord objecttype registered + published
         id: registerrecord
         run: REGISTERRECORD_TIMEOUT=120 make verify-registerrecord
+      - name: ClamAV scans a stream (EICAR found, clean OK)
+        id: clamav
+        run: CLAMAV_TIMEOUT=120 make verify-clamav
       - name: ACL ↔ OpenZaak integration tests
         id: acl
         run: make verify-acl
@@ -287,6 +290,7 @@ jobs:
           OBJECTEN: ${{ steps.objecten.outcome }}
           REGISTERRECORD: ${{ steps.registerrecord.outcome }}
           OBJECTEN_NOTIFICATIONS: ${{ steps.objecten_nrc.outcome }}
+          CLAMAV: ${{ steps.clamav.outcome }}
           ACL: ${{ steps.acl.outcome }}
           NRC: ${{ steps.nrc.outcome }}
           PROJECTION: ${{ steps.projection.outcome }}
@@ -309,6 +313,7 @@ jobs:
             echo "| Objecten API + token | $(icon "$OBJECTEN") |"
             echo "| RegisterRecord objecttype | $(icon "$REGISTERRECORD") |"
             echo "| Objecten → NRC | $(icon "$OBJECTEN_NOTIFICATIONS") |"
+            echo "| ClamAV INSTREAM scan | $(icon "$CLAMAV") |"
             echo "| ACL ↔ OpenZaak | $(icon "$ACL") |"
             echo "| OpenZaak → NRC | $(icon "$NRC") |"
             echo "| NRC → Event Subscriber → projection | $(icon "$PROJECTION") |"
@@ -328,7 +333,7 @@ jobs:
       # Log dump must precede teardown (which removes the containers).
       - name: Dump container logs on failure
         if: failure()
-        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service openbaar behandel beheer objecttypen-db objecttypen-redis objecttypen-init objecttypen objecten-db objecten-redis objecten-init objecten objecten-celery registerrecord-init tempo prometheus grafana 2>&1 || true
+        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service openbaar behandel beheer objecttypen-db objecttypen-redis objecttypen-init objecttypen objecten-db objecten-redis objecten-init objecten objecten-celery registerrecord-init clamav tempo prometheus grafana 2>&1 || true
       - name: Tear down
         if: always()
         run: make down