v0.7.2 Package Runners + CI Gate

Five package-level test runners validating extension API contracts:
- notes-runner: CRUD, folders, tags, search, backlinks (12 tests)
- chat-runner: conversations, messaging, search (9 tests)
- schedules-runner: CRUD + run (5 tests)
- workflow-runner: definitions, instances, stage progression (5 tests)
- renderer-runner: registry contract, block matching (4 tests)

Runner Result API (in-memory, 3 admin endpoints) stores results
from browser runs for CI consumption. Test-runners surface v0.2.0
posts results after each run and fixes suite prefix matching.

CI integration via Playwright: wait-for-healthy.sh, run-surface-tests.sh,
surface-test-driver.js. New test-runners stage in Gitea CI pipeline.

Verified: 169 passed, 0 failed, 9 warned, 8 skipped on fresh install.
Go handler tests: 4/4 passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -366,6 +366,52 @@ jobs:
           psql -c "DROP DATABASE IF EXISTS armature_ci;" postgres
           echo "✓ Dropped CI test database"
 
+  # ── Stage 1d: Surface Test Runners ──────────
+  # Boots the server in Docker, runs all installed test-runner packages
+  # via Playwright, and asserts zero failures.
+  #
+  # Runs when: backend or frontend changed (runners test both tiers).
+  # Skipped when: only docs changed.
+  test-runners:
+    runs-on: ubuntu-latest
+    needs: [detect-changes, test-sqlite]
+    if: |
+      !cancelled() && !failure() &&
+      (needs.detect-changes.outputs.backend == 'true' ||
+       needs.detect-changes.outputs.frontend == 'true' ||
+       needs.detect-changes.outputs.infra == 'true')
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build Docker image
+        run: docker compose build
+
+      - name: Boot server (SQLite)
+        env:
+          BUNDLED_PACKAGES: '*'
+          ARMATURE_ADMIN_USERNAME: admin
+          ARMATURE_ADMIN_PASSWORD: admin
+          ARMATURE_ADMIN_EMAIL: admin@test.local
+        run: docker compose up -d
+
+      - name: Wait for healthy
+        run: ./ci/wait-for-healthy.sh http://localhost:3000
+
+      - name: Install Playwright
+        run: npx playwright install --with-deps chromium
+
+      - name: Run surface tests
+        env:
+          SERVER_URL: http://localhost:3000
+          ADMIN_USER: admin
+          ADMIN_PASS: admin
+        run: ./ci/run-surface-tests.sh
+
+      - name: Teardown
+        if: always()
+        run: docker compose down -v
+
   # ── Stage 2: Build, Database, Deploy ─────────
   #
   # Depends on all test jobs. Skipped jobs (due to path gating)
@@ -374,7 +420,7 @@ jobs:
   # Skipped entirely for docs-only changes (nothing to build).
   build-and-deploy:
     runs-on: ubuntu-latest
-    needs: [detect-changes, test-go-pg, test-frontend, test-sqlite]
+    needs: [detect-changes, test-go-pg, test-frontend, test-sqlite, test-runners]
     # Run unless: a needed job failed, the workflow was cancelled, or it's docs-only.
     # Skipped test jobs (path-gated) are fine — they don't block.
     if: |