ci: drive pipeline via make targets + local make ci gate (refs #30)

Add a root Makefile (lint/build/unit/smoke/ci) as the single source of
truth for the checks, and have each Gitea Actions job call the matching
make target so local and CI cannot drift. `make ci` runs the full
pipeline locally — the interim gate while no runner is registered.

The smoke target auto-points DOCKER_HOST at the rootless Podman socket
when present (and DOCKER_HOST is unset), leaving Docker/CI hosts alone.
Document `make ci` and the Podman prerequisites in docs/runbooks/ci.md.

Verified: `make ci` is green locally (lint, build, unit, container smoke).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -12,6 +12,9 @@ permissions:
 # Self-hosted runner — see docs/runbooks/ci.md for the runner setup.
 # `uses:` are absolute, tag-pinned URLs (CLAUDE.md §8.7 / §15).
 
+# Each job calls a `make` target — the same one developers run locally
+# (`make ci`). The Makefile is the single source of truth; see docs/runbooks/ci.md.
+
 jobs:
   lint:
     runs-on: respellion-linux
@@ -20,8 +23,7 @@ jobs:
       - uses: https://github.com/actions/setup-dotnet@v4
         with:
           dotnet-version: '10.0.x'
-      - name: dotnet format (verify, no changes)
-        run: dotnet format services/bff/Bff.slnx --verify-no-changes
+      - run: make lint
 
   build:
     runs-on: respellion-linux
@@ -30,7 +32,7 @@ jobs:
       - uses: https://github.com/actions/setup-dotnet@v4
         with:
           dotnet-version: '10.0.x'
-      - run: dotnet build services/bff/Bff.slnx -c Release
+      - run: make build
 
   unit:
     runs-on: respellion-linux
@@ -39,16 +41,10 @@ jobs:
       - uses: https://github.com/actions/setup-dotnet@v4
         with:
           dotnet-version: '10.0.x'
-      - run: dotnet test services/bff/Bff.slnx -c Release
+      - run: make unit
 
   compose-smoke:
     runs-on: respellion-linux
     steps:
       - uses: https://github.com/actions/checkout@v4
-      - name: compose up (wait for healthy)
-        run: docker compose -f infra/docker-compose.yml up -d --build --wait
-      - name: smoke test /health
-        run: curl -fsS http://localhost:8080/health
-      - name: compose down
-        if: always()
-        run: docker compose -f infra/docker-compose.yml down --volumes
+      - run: make smoke