Add Gitea build, container tests and registry publication

docs/s4-validation.md

@@ -0,0 +1,75 @@
+# S4 verification evidence
+
+Date: 2026-10-28. Status: repository implementation and local container verification
+passed; operational Gitea acceptance remains pending. S4 is **not complete**.
+
+## Verified locally
+
+- Gitea reports version 1.25.4; repository `wanjakrah/agiledancers` has Actions
+  enabled and uses `main` as its default branch.
+- Docker Desktop was started on the existing Linux x86_64 mini-PC. Its Docker
+  daemon reports `linux/x86_64` (`linux/amd64`). This is not evidence of the
+  Synology's architecture.
+- `mvn clean verify` passed, including all 20 backend tests and architecture tests.
+- `npm ci`, all 14 frontend unit tests with JUnit output, and the production build
+  passed in the full verification script.
+- Both runtime images built successfully with the `prebuilt` targets. The images
+  package the same outputs that passed verification.
+- Both existing Playwright tests passed (2/2) using the built frontend and backend
+  containers, the frontend `/api/` proxy and Chromium in the version-matched
+  Playwright container. No Angular development server was used.
+- The full `ci/verify.sh` execution exited successfully; its trap removed all three
+  temporary test containers and the run network.
+- Eleven isolated CI tests pass: failed verification removes its success marker,
+  feature branches do not publish, unverified commits cannot publish, reruns
+  preserve commit tags, partial publication is recoverable, authentication and
+  pull failures block publication, older commits do not move `main`, platform
+  mismatches fail, and daemon configuration preserves existing settings.
+- Shell syntax, Python compilation, workflow YAML parsing and the changed files'
+  whitespace checks passed.
+- Runner v0.2.13 was downloaded from the official source, SHA-256 checked, and
+  installed with its user-service configuration using `--prepare-only`.
+  The runner was subsequently registered and its user service started using the
+  supplied repository administration credentials.
+- The internal registry was merged into Docker Desktop's daemon configuration,
+  preserving existing settings and a backup. Docker Desktop was restarted and
+  the running daemon confirmed that `192.168.2.28:3000` is an active HTTP registry.
+
+Local outputs are in `ci/artifacts/` (ignored by Git): verify log, backend test
+reports, frontend unit JUnit report, Playwright JUnit/HTML report and container
+logs. These are local files, not yet artifacts uploaded by a real Gitea run.
+The unit JUnit report uses a separate directory so Playwright output cleanup
+cannot delete it.
+
+The local test used working-tree changes on base commit
+`e3e362c2ac30d6b365f752f3da6c8b0250c019db`, with run ID `s4local`. These local
+images are test outputs, not published release images for that commit.
+
+Local image IDs (not registry digests):
+
+- Backend: `sha256:bd77a46e3dbdcaea9662d21c608098999fe17dfdf241cd28a24a935f47401f61`.
+- Frontend: `sha256:ce8e6ab21fb8f9cbee280ac2c4d7b4ca24a30e899a457382f1e45c6baf99dfb6`.
+
+## Remaining operational acceptance
+
+- [x] Synology architecture confirmed by the maintainer: `x86_64`,
+      `linux/amd64`; repository variable `TARGET_PLATFORM=linux/amd64` configured.
+- [x] Activate and verify the Docker Desktop HTTP-registry setting.
+- [x] Repository `REGISTRY_USER`/`REGISTRY_TOKEN` secrets configured using the
+      supplied token files. Registry access is verified by actual publication below.
+- [ ] Obtain a repository runner registration token and register/start the
+      installed mini-PC runner; verify it is online in Gitea.
+- [ ] Confirm server settings permit every branchpush (including messages with
+      skip strings) and retain uploaded diagnostic artifacts for fourteen days.
+- [ ] Real feature-branch run: record URL/run ID, successful container-E2E and
+      absence of publication.
+- [ ] Real intentionally failing test/build run: record URL/run ID, blocked
+      publication and downloadable failure artifacts.
+- [ ] Real main run: record URL/run ID, both full-SHA images, successful pullback,
+      registry digests and the two `main` aliases.
+- [ ] Real rerun/partial-publication recovery and stale-main evidence: record
+      run IDs and unchanged existing commit digests.
+
+The isolated publication tests provide automated control-flow coverage; they do
+not substitute for real authenticated registry/Gitea acceptance runs. No application
+images have been published and no application has been deployed by this work.