fix(ci): install Compose for ingress configuration checks

.gitea/workflows/ci-deploy.yml

@@ -55,9 +55,18 @@ jobs:
         with:
           node-version: '20'
 
+      - name: Setup Compose for configuration checks
+        # This runner has no Docker CLI/daemon. The official action installs a
+        # standalone Compose CLI; rendering config never needs engine access.
+        uses: docker/setup-compose-action@2fe291b7677a45ee1269ec56a42604c143505e7e # v1
+        with:
+          version: v5.3.1
+          cache-binary: false
+        env:
+          GITHUB_TOKEN: '' # Public release download; never send a Gitea token to GitHub.
+
       - name: Test repository safety scripts
-        # Standard-library only and plan-only: this validates the synthetic benchmark harness
-        # without contacting Ollama, pulling a model, or requiring package installation.
+        # Python standard library and Compose config rendering only; no services start.
         run: |
           python3 scripts/test-ollama-evaluation.py
           python3 scripts/test-supply-chain.py

docs/audits/2026-09-07/validation/b06-completion.md

@@ -308,3 +308,11 @@ Return only selected sanitized excerpts and the timestamp/test vantage point. **
 4. **Still requires operator verification:** deployed build/topology/trust CIDRs, actual socket peers, backend client IP/scheme, real-chain session/account/IP behavior, host/container listeners and other network memberships, host/provider IPv4/IPv6 firewall/NAT, independent external reachability, intended DNS-address inventory and correct HTTP redirect target.
 
 The blocking items are therefore the unavailable local Docker engine, absent verified production host access/evidence, missing real-chain peer/identity tests, and the observed HTTP redirect mismatch. **B06 implementation complete, but F04 remains open.** No change to F04's conditional severity or closure status is justified by connection failures alone.
+
+## Authorized release attempt and CI prerequisite correction
+
+Connor subsequently authorized commit/push to live. B01–B06 were committed as `0954876`, and the redesign brief as `1bbbd05`; both were pushed to `main`. [Gitea run 736](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/736/jobs/1607) failed before backend/frontend testing: `scripts/test-ingress.py` raised `FileNotFoundError: 'docker'` in the runner. Deployment was skipped; the push was not a successful live rollout.
+
+The workflow now installs pinned Compose v5.3.1 through the [official Docker setup action](https://github.com/docker/setup-compose-action), pinned to commit `2fe291b7677a45ee1269ec56a42604c143505e7e`. It installs the standalone `compose` command when Docker CLI is absent, without requiring engine access. Gitea tokens are not passed to the public GitHub download. The config test accepts that supported standalone command, retaining `docker compose` on existing Docker installations. Nothing is skipped and the production ingress gate remains unchanged.
+
+Validation before the corrective push: **3/3 tests through `docker compose` and 3/3 through the real standalone binary** with Docker discovery disabled for the latter fixture; tracked-secret scan and `git diff --check` pass. This corrects a CI dependency assumption; it neither repairs local Docker Desktop nor supplies any missing F04 deployment evidence.

scripts/test-ingress.py

@@ -4,6 +4,7 @@ import importlib.util
 import json
 import os
 from pathlib import Path
+import shutil
 import subprocess
 import tempfile
 import unittest
@@ -24,7 +25,9 @@ class IngressConfigTests(unittest.TestCase):
             file.write("# No repository secrets are read by this fixture.\n")
             path = file.name
         try:
-            base = ["docker", "compose", "--env-file", path, "-f", "docker-compose.yml"]
+            # docker/setup-compose-action supplies `compose` on runners without Docker.
+            command = ["docker", "compose"] if shutil.which("docker") else [shutil.which("compose") or "docker-compose"]
+            base = command + ["--env-file", path, "-f", "docker-compose.yml"]
             def render(extra):
                 result = subprocess.run(base + extra + ["--profile", "bundled-ollama", "config", "--format", "json"],
                                         cwd=ROOT, env=env, capture_output=True, text=True, timeout=30, check=True)