Feat v0.7.2 package runners ci gate (#56)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

.gitea/workflows/ci.yaml

@@ -366,6 +366,40 @@ jobs:
           psql -c "DROP DATABASE IF EXISTS armature_ci;" postgres
           echo "✓ Dropped CI test database"
 
+  # ── Stage 1d: Surface Test Runners ──────────
+  # Boots the server in Docker, runs all installed test-runner packages
+  # via Playwright, and asserts zero failures.
+  #
+  # DISABLED: Playwright driver can't find the Run All button in headless
+  # mode — likely a shell/SPA rendering issue.  Run manually from the
+  # test-runners surface after deploy until this is resolved.
+  # See: docker-compose.ci.yml, ci/surface-test-driver.js
+  #
+  # Runs when: backend or frontend changed (runners test both tiers).
+  # Skipped when: only docs changed.
+  test-runners:
+    runs-on: ubuntu-latest
+    needs: [detect-changes]
+    if: false  # disabled — see comment above
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run surface tests (compose)
+        env:
+          BUNDLED_PACKAGES: '*'
+          ARMATURE_ADMIN_USERNAME: admin
+          ARMATURE_ADMIN_PASSWORD: admin
+          ARMATURE_ADMIN_EMAIL: admin@test.local
+        run: |
+          docker compose -f docker-compose.yml -f docker-compose.ci.yml up --build \
+            --abort-on-container-exit \
+            --exit-code-from test-runner
+
+      - name: Teardown
+        if: always()
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml down -v
+
   # ── Stage 2: Build, Database, Deploy ─────────
   #
   # Depends on all test jobs. Skipped jobs (due to path gating)
@@ -374,7 +408,7 @@ jobs:
   # Skipped entirely for docs-only changes (nothing to build).
   build-and-deploy:
     runs-on: ubuntu-latest
-    needs: [detect-changes, test-go-pg, test-frontend, test-sqlite]
+    needs: [detect-changes, test-go-pg, test-frontend, test-sqlite, test-runners]
     # Run unless: a needed job failed, the workflow was cancelled, or it's docs-only.
     # Skipped test jobs (path-gated) are fine — they don't block.
     if: |