fix(ci): bootstrap Compose without a GitHub token

.gitea/workflows/ci-deploy.yml

@@ -56,14 +56,19 @@ jobs:
           node-version: '20'
 
       - name: Setup Compose for configuration checks
-        # This runner has no Docker CLI/daemon. The official action installs a
+        # No Docker daemon or GitHub token is required for config rendering.
-        # standalone Compose CLI; rendering config never needs engine access.
+        # Pin the official Linux x86_64 release and verify before execution.
-        uses: docker/setup-compose-action@2fe291b7677a45ee1269ec56a42604c143505e7e # v1
+        shell: bash
-        with:
+        run: |
-          version: v5.3.1
+          test "$(uname -m)" = x86_64
-          cache-binary: false
+          compose_dir="$(mktemp -d)"
-        env:
+          curl --fail --silent --show-error --location --retry 3 \
-          GITHUB_TOKEN: '' # Public release download; never send a Gitea token to GitHub.
+            https://github.com/docker/compose/releases/download/v5.3.1/docker-compose-linux-x86_64 \
+            -o "$compose_dir/docker-compose"
+          echo "f9ebc6ebdb19d769b793c245a736caaeb198c62587f13b25c660c13b4987f959  $compose_dir/docker-compose" | sha256sum --check --strict
+          chmod +x "$compose_dir/docker-compose"
+          "$compose_dir/docker-compose" version
+          echo "$compose_dir" >> "$GITHUB_PATH"
 
       - name: Test repository safety scripts
         # Python standard library and Compose config rendering only; no services start.

docs/audits/2026-09-07/validation/b06-completion.md

@@ -313,6 +313,8 @@ The blocking items are therefore the unavailable local Docker engine, absent ver
 
 Connor subsequently authorized commit/push to live. B01–B06 were committed as `0954876`, and the redesign brief as `1bbbd05`; both were pushed to `main`. [Gitea run 736](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/736/jobs/1607) failed before backend/frontend testing: `scripts/test-ingress.py` raised `FileNotFoundError: 'docker'` in the runner. Deployment was skipped; the push was not a successful live rollout.
 
-The workflow now installs pinned Compose v5.3.1 through the [official Docker setup action](https://github.com/docker/setup-compose-action), pinned to commit `2fe291b7677a45ee1269ec56a42604c143505e7e`. It installs the standalone `compose` command when Docker CLI is absent, without requiring engine access. Gitea tokens are not passed to the public GitHub download. The config test accepts that supported standalone command, retaining `docker compose` on existing Docker installations. Nothing is skipped and the production ingress gate remains unchanged.
+The first correction (`f485f72`) attempted to install pinned Compose v5.3.1 through the [official Docker setup action](https://github.com/docker/setup-compose-action), pinned to commit `2fe291b7677a45ee1269ec56a42604c143505e7e`. Gitea tokens were deliberately not passed to GitHub. The config test accepts standalone Compose, retaining `docker compose` on existing Docker installations. Nothing is skipped and the production ingress gate remains unchanged.
 
 Validation before the corrective push: **3/3 tests through `docker compose` and 3/3 through the real standalone binary** with Docker discovery disabled for the latter fixture; tracked-secret scan and `git diff --check` pass. This corrects a CI dependency assumption; it neither repairs local Docker Desktop nor supplies any missing F04 deployment evidence.
+
+[Run 737](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/737/jobs/1609) then failed in the action itself: `Parameter token or opts.auth is required`; deployment again skipped. The final setup uses the [official standalone release](https://github.com/docker/compose/releases/tag/v5.3.1) directly, in a runner-local temporary directory. It pins Linux x86_64 and SHA-256 `f9ebc6ebdb19d769b793c245a736caaeb198c62587f13b25c660c13b4987f959`, verifies before execution, and needs neither a daemon nor an authentication token. A fresh local download matches that official release digest; 3/3 ingress config tests and diff validation pass. Runner execution and deployment are tracked separately from these local checks.

scripts/test-ingress.py

@@ -25,7 +25,7 @@ class IngressConfigTests(unittest.TestCase):
             file.write("# No repository secrets are read by this fixture.\n")
             path = file.name
         try:
-            # docker/setup-compose-action supplies `compose` on runners without Docker.
+            # CI installs standalone Compose; developer machines can use the Docker plugin.
             command = ["docker", "compose"] if shutil.which("docker") else [shutil.which("compose") or "docker-compose"]
             base = command + ["--env-file", path, "-f", "docker-compose.yml"]
             def render(extra):