refactor(ci): one verify-stack stage for all live-stack checks (closes #58) (refs #46 #56)

On the single self-hosted runner CI jobs run sequentially, so booting OpenZaak once
beats once-per-job. Replace the integration + notifications + compose-smoke jobs with
one verify-stack job that brings the full stack up once and runs, as clearly-named
steps: health (make verify-up, the DoD smoke) → ACL ↔ OpenZaak (verify-acl) →
OpenZaak → NRC delivery (verify-nrc) → teardown (always) + log dump on failure.

The check logic moves into stack-agnostic runners (run-acl-integration.sh,
run-notification-check.sh) that operate on whatever stack is already up, reaching
services by container IP. The local single-concern wrappers (make integration oz-only,
make verify-notifications oz+nrc) keep working by delegating to the same runners, so
nothing is duplicated. make ci now runs the consolidated 'verify' stage.

Verified locally: make verify boots the full stack once, ACL integration passes and
the NRC notification is delivered, then tears down.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/runbooks/gitea-actions-gotchas.md

@@ -173,7 +173,7 @@ reality is a service name or an IPv4 literal — and only the IP passes.
 **Fix** — in-network tooling reaches OpenZaak/NRC by **container IP**
 (`docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}'`), not
 service name; the notif verify harness also registers the sink callback by IP.
-(`infra/run-integration.sh`, `infra/verify-notifications.sh`.)
+(`infra/run-acl-integration.sh`, `infra/run-notification-check.sh`.)
 
 **Related — abonnement callbacks must enforce auth.** NRC probes a callback when an
 abonnement is registered and refuses it (`no-auth-on-callback-url`) unless it returns