fix(infra): harden oz-db healthcheck and raise compose-up timeout (refs #30)

Three root-cause fixes for the oz-init CI failure:

1. Smoke timeout: add --wait-timeout 300 to `docker compose up --wait`
   so CI has 5 minutes instead of the 60-second default in older Compose
   v2 releases (migrations alone take 50 s locally).

2. PostGIS race: the old healthcheck used pg_isready which only checks
   TCP connectivity — it passes before the postgis/postgis init scripts
   have run SELECT PostGIS_Version(). The new check adds a psql probe so
   oz-init does not start until PostGIS is actually available.

3. Remove :z from volume mounts: the SELinux re-label flag is
   Podman/Fedora-specific and a no-op (or unexpected) under Docker on
   ubuntu-latest; plain :ro is correct for both runtimes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/docker-compose.yml

@@ -33,10 +33,13 @@ services:
     volumes:
       - oz-db:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak"]
+      # pg_isready only checks TCP; the second clause verifies PostGIS is installed
+      # so oz-init migrations can safely start (avoids race on cold container start).
+      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak && psql -U openzaak -d openzaak -c 'SELECT PostGIS_Version();' -q 2>/dev/null"]
       interval: 5s
-      timeout: 3s
-      retries: 10
+      timeout: 5s
+      retries: 30
+      start_period: 15s
     networks: [cg]
 
   oz-redis:
@@ -66,7 +69,7 @@ services:
       RUN_SETUP_CONFIG: "true"
     command: /setup_configuration.sh
     volumes:
-      - ./openzaak/setup_configuration:/app/setup_configuration:ro,z
+      - ./openzaak/setup_configuration:/app/setup_configuration:ro
     depends_on:
       oz-db:
         condition: service_healthy
@@ -142,7 +145,7 @@ services:
       RUN_SETUP_CONFIG: "true"
     command: /setup_configuration.sh
     volumes:
-      - ./opennotificaties/setup_configuration:/app/setup_configuration:ro,z
+      - ./opennotificaties/setup_configuration:/app/setup_configuration:ro
     depends_on:
       nrc-db:
         condition: service_healthy
@@ -191,7 +194,7 @@ services:
     ports:
       - "8180:8080"
     volumes:
-      - ./keycloak/realms:/opt/keycloak/data/import:ro,z
+      - ./keycloak/realms:/opt/keycloak/data/import:ro
     networks: [cg]
 
   # ── Flowable (S-03) ──────────────────────────────────────────────────────
@@ -228,7 +231,7 @@ services:
     image: docker.io/curlimages/curl:latest
     restart: "no"
     volumes:
-      - ../workflows/registratie.bpmn:/work/registratie.bpmn:ro,z
+      - ../workflows/registratie.bpmn:/work/registratie.bpmn:ro
     command:
       - sh
       - -c