fix(infra): portable health poll instead of compose --wait (refs #30)

`make smoke` errored locally because podman-compose doesn't implement
`docker compose up --wait` (`unrecognized arguments: --wait`).

Replace the `--wait` step with infra/wait-healthy.sh, which polls each durable
health-checked service ($(WAIT_SVCS)) via `docker ps` + `docker inspect
'{{.State.Health.Status}}'`. This:

- works on both docker compose (CI) and podman-compose (local) — only plain
  docker primitives, no `--wait`;
- reads the in-container healthcheck, so it needs no host port access (the CI
  runner can't reach published ports);
- ignores the one-shot init jobs, sidestepping the "--wait fails when a
  consumer-less one-shot exits 0" issue (flowable-init).

Verified on podman-compose: wait-healthy.sh reports bff healthy (rc=0); podman
exposes .State.Health.Status (starting -> healthy) and the name filter matches
both `_` and `-` container naming.

Docs: gitea-actions-gotchas.md updated (the two `--wait` sections folded into one
"portable health poll" section).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/wait-healthy.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+#
+# Wait until the named compose services report a healthy healthcheck.
+#
+# Portable across `docker compose` (CI) and `podman-compose` (local dev): it uses
+# plain `docker ps` + `docker inspect`, so it needs neither `docker compose
+# up --wait` (podman-compose doesn't implement that flag) nor host port access
+# (the containerized CI runner can't reach published ports). It also sidesteps the
+# `--wait`-fails-when-a-one-shot-exits issue, since we only poll long-running
+# services that declare a healthcheck. See docs/runbooks/gitea-actions-gotchas.md.
+#
+# Usage: WAIT_TIMEOUT=420 wait-healthy.sh <service> [<service> ...]
+set -euo pipefail
+
+timeout="${WAIT_TIMEOUT:-420}"
+deadline=$(( $(date +%s) + timeout ))
+
+# compose service name -> container id. The name filter matches both docker
+# compose ("infra-openzaak-1") and podman-compose ("infra_openzaak_1") naming.
+cid_for() { docker ps -aq --filter "name=$1" | head -1; }
+
+for svc in "$@"; do
+  echo "waiting for '$svc' to be healthy (timeout ${timeout}s)..."
+  while :; do
+    cid="$(cid_for "$svc")"
+    status=""
+    [ -n "$cid" ] && status="$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' "$cid" 2>/dev/null || true)"
+    [ "$status" = "healthy" ] && { echo "  '$svc' is healthy"; break; }
+    if [ "$(date +%s)" -ge "$deadline" ]; then
+      echo "TIMEOUT: '$svc' not healthy (status=${status:-no-container})" >&2
+      docker ps -a --filter "name=$svc" >&2 || true
+      exit 1
+    fi
+    sleep 3
+  done
+done