fix(infra): smoke waits on durable services, not the whole project (refs #30)

Run 28 got the full stack healthy but `compose-smoke` still failed. The last
compose line before the error was:

  container infra-flowable-init-1 exited (0)

`docker compose up --wait` treats a service that exits as a failure of the
"stay running" condition unless something depends on it via
`service_completed_successfully`. oz-init/nrc-init are fine (openzaak/nrc-web
depend on them), but flowable-init deploys the BPMN and exits 0 with no
dependant, so whole-project `--wait` failed the instant it finished — even
though everything else was healthy and nrc-init now exits 0.

Smoke now:
  1. `up -d` starts the full stack (one-shots run + deploy as before), then
  2. `up -d --wait <WAIT_SVCS>` waits only for the durable health-checked
     services (openzaak nrc-web acl bff).

Also drops the external `curl localhost:8080/health`: the containerized CI
runner can't reach published host ports at localhost, and each service's
healthcheck already runs inside its container — so `--wait` succeeding IS the
smoke. Documented in docs/runbooks/gitea-actions-gotchas.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Makefile

@@ -7,7 +7,11 @@
 
 SLN        := register-referentie.slnx
 COMPOSE    := infra/docker-compose.yml
-HEALTH_URL := http://localhost:8080/health
+# Long-running services with a healthcheck — the smoke waits on these. One-shot
+# init jobs (oz-init, nrc-init, flowable-init) are NOT listed: `--wait` fails when
+# a one-shot with no `service_completed_successfully` dependant exits (flowable-init),
+# so we wait on the durable services instead. See docs/runbooks/gitea-actions-gotchas.md.
+WAIT_SVCS  := openzaak nrc-web acl bff
 OZ_COMPOSE  := infra/openzaak/docker-compose.yml
 OZ_BASE     := http://localhost:8000
 NRC_COMPOSE := infra/opennotificaties/docker-compose.yml
@@ -45,10 +49,15 @@ build:
 unit:
 	dotnet test $(SLN) -c Release
 
-## smoke: compose up (wait for healthy), curl /health, then tear down
+## smoke: bring the whole stack up, wait for the health-checked services, tear down
+# Step 1 starts EVERYTHING (incl. one-shot init jobs that deploy and exit 0).
+# Step 2 waits only for the durable, health-checked services ($(WAIT_SVCS)) — see
+# WAIT_SVCS above for why the one-shots are excluded. The healthchecks run inside
+# the containers, so this needs no host port access (the CI runner can't reach
+# published ports anyway).
 smoke:
-	docker compose -f $(COMPOSE) up -d --build --wait --wait-timeout 420
-	bash -c 'curl -fsS $(HEALTH_URL); rc=$$?; docker compose -f $(COMPOSE) down --volumes; exit $$rc'
+	docker compose -f $(COMPOSE) up -d --build
+	bash -c 'docker compose -f $(COMPOSE) up -d --wait --wait-timeout 420 $(WAIT_SVCS); rc=$$?; docker compose -f $(COMPOSE) down --volumes; exit $$rc'
 
 ## down: stop and remove the local stack
 down: