ci(acl): run the ACL integration test as a Gitea Actions job (refs #46)

New integration job: setup-dotnet + make integration (stack up, OZ_PUBLISH=1 seed,
Integration-category tests, tear down), with on-failure log dump + teardown like
compose-smoke. Documents the job and the new make target in the CI runbook.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -63,6 +63,25 @@ jobs:
           path: services/acl/StrykerOutput/**/reports/mutation-report.html
           if-no-files-found: warn
 
+  integration:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+      - uses: https://github.com/actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+      # `make integration` brings the OpenZaak stack up, seeds a PUBLISHED BIG
+      # zaaktype (OZ_PUBLISH=1) and runs the Integration-category tests, then tears
+      # down. Needs Docker + python3 (both on ubuntu-latest) and outbound access to
+      # selectielijst.openzaak.nl from the OpenZaak container (see ADR-0006).
+      - run: make integration
+      - name: dump OpenZaak logs on failure
+        if: failure()
+        run: docker compose -f infra/openzaak/docker-compose.yml logs --no-color --tail=80 oz-init openzaak 2>&1 || true
+      - name: tear down on failure
+        if: failure()
+        run: docker compose -f infra/openzaak/docker-compose.yml down --volumes 2>&1 || true
+
   compose-smoke:
     runs-on: ubuntu-latest
     steps:

docs/runbooks/ci.md

@@ -15,8 +15,9 @@ and CI cannot drift:
 |---|---|---|
 | `lint` | `make lint` → `dotnet format … --verify-no-changes` | .NET 10 SDK |
 | `build` | `make build` → `dotnet build … -c Release` | .NET 10 SDK |
-| `unit` | `make unit` → `dotnet test … -c Release` | .NET 10 SDK |
+| `unit` | `make unit` → `dotnet test … -c Release --filter "Category!=Integration"` | .NET 10 SDK |
 | `mutation` | `make mutation` → `dotnet tool restore` → `dotnet stryker` (ACL); uploads the HTML report as an artifact | .NET 10 SDK |
+| `integration` | `make integration` → `openzaak-up` → seed a **published** BIG zaaktype (`OZ_PUBLISH=1`) → `dotnet test … --filter "Category=Integration"` → tear down | .NET 10 SDK + container engine + python3 + egress to `selectielijst.openzaak.nl` |
 | `compose-smoke` | `make smoke` → seed config volumes → `up -d` (full stack) → `up --wait` durable services → `down` | container engine + compose v2 |
 
 All `uses:` references are absolute, tag-pinned URLs (`https://github.com/actions/checkout@v4`,
@@ -88,12 +89,17 @@ the containerized CI runner). Keep the two files in sync.
 Until the runner exists, run the full pipeline yourself before pushing:
 
 ```bash
-make ci          # lint + build + unit + mutation + smoke — what the pipeline runs
+make ci          # lint + build + unit + mutation + smoke — the fast pipeline lanes
 make lint        # or a single stage
 make mutation    # Stryker.NET ratchet on the ACL
 make smoke       # compose up --wait, curl /health, tear down
+make integration # ACL ↔ real OpenZaak (its own CI job; not part of `make ci`)
 ```
 
+> `make integration` is a separate, heavier lane (it stands the OpenZaak stack up and
+> seeds a published zaaktype), so it is **not** folded into `make ci`. Run it before
+> pushing changes that touch the ACL gateway or the OpenZaak seed. See ADR-0006.
+
 **Prerequisites:** .NET 10 SDK, a container engine with Compose v2, and `curl`.
 
 On a **rootless Podman** box (the default dev setup here), the `smoke` target needs