ci(acl): run the ACL integration test as a Gitea Actions job (refs #46)

New integration job: setup-dotnet + make integration (stack up, OZ_PUBLISH=1 seed,
Integration-category tests, tear down), with on-failure log dump + teardown like
compose-smoke. Documents the job and the new make target in the CI runbook.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -63,6 +63,25 @@ jobs:
           path: services/acl/StrykerOutput/**/reports/mutation-report.html
           if-no-files-found: warn
 
+  integration:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+      - uses: https://github.com/actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+      # `make integration` brings the OpenZaak stack up, seeds a PUBLISHED BIG
+      # zaaktype (OZ_PUBLISH=1) and runs the Integration-category tests, then tears
+      # down. Needs Docker + python3 (both on ubuntu-latest) and outbound access to
+      # selectielijst.openzaak.nl from the OpenZaak container (see ADR-0006).
+      - run: make integration
+      - name: dump OpenZaak logs on failure
+        if: failure()
+        run: docker compose -f infra/openzaak/docker-compose.yml logs --no-color --tail=80 oz-init openzaak 2>&1 || true
+      - name: tear down on failure
+        if: failure()
+        run: docker compose -f infra/openzaak/docker-compose.yml down --volumes 2>&1 || true
+
   compose-smoke:
     runs-on: ubuntu-latest
     steps: