refactor(ci): one verify-stack stage for all live-stack checks (closes #58) (refs #46 #56)

On the single self-hosted runner CI jobs run sequentially, so booting OpenZaak once
beats once-per-job. Replace the integration + notifications + compose-smoke jobs with
one verify-stack job that brings the full stack up once and runs, as clearly-named
steps: health (make verify-up, the DoD smoke) → ACL ↔ OpenZaak (verify-acl) →
OpenZaak → NRC delivery (verify-nrc) → teardown (always) + log dump on failure.

The check logic moves into stack-agnostic runners (run-acl-integration.sh,
run-notification-check.sh) that operate on whatever stack is already up, reaching
services by container IP. The local single-concern wrappers (make integration oz-only,
make verify-notifications oz+nrc) keep working by delegating to the same runners, so
nothing is duplicated. make ci now runs the consolidated 'verify' stage.

Verified locally: make verify boots the full stack once, ACL integration passes and
the NRC notification is delivered, then tears down.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -63,47 +63,27 @@ jobs:
           path: services/acl/StrykerOutput/**/reports/mutation-report.html
           if-no-files-found: warn
 
-  integration:
+  # One stage for every check that needs the live stack. On the single self-hosted
+  # runner jobs run sequentially, so booting OpenZaak once (instead of once per job)
+  # is the cheapest layout (issue #58). No setup-dotnet: the ACL test runs in a built
+  # image and everything reaches services by container IP. Needs Docker + egress
+  # (base images, nuget, selectielijst.openzaak.nl).
+  verify-stack:
     runs-on: ubuntu-latest
     steps:
       - uses: https://github.com/actions/checkout@v4
-      # No setup-dotnet: `make integration` runs the seed and the test as containers
-      # *inside* the OpenZaak compose network (reaching it by container IP), so dotnet
-      # lives in the test image and the runner needs only Docker. This sidesteps the
-      # runner being unable to reach published ports (gitea-actions-gotchas.md §5).
-      # Needs egress to pull base images + nuget + selectielijst.openzaak.nl.
-      - run: make integration
-      - name: dump OpenZaak logs on failure
+      # Bring the full stack up + wait for health — this also is the DoD "compose up
+      # reaches green health" smoke (it replaces the old compose-smoke job).
+      - name: Bring up the full stack & wait for health
+        run: make verify-up
+      - name: ACL ↔ OpenZaak integration tests
+        run: make verify-acl
+      - name: OpenZaak → NRC notification delivery
+        run: make verify-nrc
+      # Log dump must precede teardown (which removes the containers).
+      - name: Dump container logs on failure
         if: failure()
-        run: docker compose -f infra/openzaak/docker-compose.yml logs --no-color --tail=80 oz-init openzaak 2>&1 || true
-      - name: tear down on failure
-        if: failure()
-        run: docker compose -f infra/openzaak/docker-compose.yml down --volumes 2>&1 || true
-
-  notifications:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: https://github.com/actions/checkout@v4
-      # `make verify-notifications` brings up OpenZaak + NRC, seeds, and asserts a
-      # zaak-create notification is delivered to a subscriber — all via containers on
-      # the compose network (the runner can't reach published ports; §5). Needs only
-      # Docker + egress (base images, selectielijst.openzaak.nl).
-      - run: make verify-notifications
-      - name: dump OpenZaak/NRC logs on failure
-        if: failure()
-        run: docker compose -f infra/openzaak/docker-compose.yml -f infra/opennotificaties/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat 2>&1 || true
-      - name: tear down on failure
-        if: failure()
-        run: docker compose -f infra/openzaak/docker-compose.yml -f infra/opennotificaties/docker-compose.yml down --volumes 2>&1 || true
-
-  compose-smoke:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: https://github.com/actions/checkout@v4
-      - run: make smoke
-      - name: dump container logs on failure
-        if: failure()
-        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=80 oz-init openzaak nrc-init nrc-web flowable-init keycloak acl bff 2>&1 || true
-      - name: tear down on failure
-        if: failure()
-        run: docker compose -f infra/docker-compose.yml down --volumes 2>&1 || true
+        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-init keycloak acl bff 2>&1 || true
+      - name: Tear down
+        if: always()
+        run: make down