TASK: Replace integration lane with post-build backend runtime black-box tests (#72)

## Summary

Replace the existing source-context integration lane with backend runtime black-box integration checks that run against started deployable containers.

This change wires deployable backend image references (both commit tag and immutable digest) from the build workflow into the tests workflow, then validates runtime behavior over network endpoints.

## Why

Integration confidence should come from testing running service artifacts, not only source-mounted or in-process execution.

## What Changed

- Build workflow now:
  - Publishes deployable backend image tag reference and digest reference
  - Exposes both as job outputs
  - Passes both references into CICD Tests dispatch inputs

- CICD Tests workflow now:
  - Accepts deployable backend tag and digest inputs
  - Propagates these through setup outputs
  - Replaces previous integration lane behavior with runtime black-box execution:
    - Starts isolated Docker network
    - Starts Postgres container
    - Starts backend container from digest-pinned deployable image
    - Enforces tag-to-digest consistency before running checks
    - Runs endpoint checks against live container:
      - GET /
      - GET /compatibility
      - GET /health
    - Captures backend/db logs and container state on failure
    - Cleans up containers and network via trap

- Documentation updated:
  - Runtime contract enforcement section now includes runtime black-box integration checks
  - CI success summary now reflects runtime integration lane behavior

## Scope

Included:
- Backend runtime black-box integration replacement for the existing integration lane
- Digest + tag identity enforcement
- Failure diagnostics for triage

Out of scope:
- Frontend runtime smoke checks
- E2E lane redesign

## Acceptance Criteria Mapping

- Integration tests execute against runtime container endpoints: ✅
- Integration lane consumes built image references (not source-mounted execution): ✅
- Failures surface service logs and test logs for triage: ✅

## Verification

- Workflow files pass local validation checks
- Pre-commit hooks pass on committed changes
- Branch pushed and ready for PR review

## Related

- Issue: #61
- Dependency context: #66

Co-authored-by: copilotcoder <copilotcoder@darkhelm.org>
Reviewed-on: #72

docs/CICD_SUCCESS_SUMMARY.md

@@ -33,6 +33,8 @@
 - **E2E Tests**: Simplified Docker approach matching other successful test patterns
 - **Playwright**: Chromium-only CI strategy (95%+ browser market coverage)
 - **Registry Operations**: Consistent approach across all test phases
+- **Backend Runtime Integration**: Black-box checks run against started deployable
+  backend containers with commit-tag and digest pinning
 
 ## 🛠️ **Critical Issues Resolved**
 
@@ -82,6 +84,8 @@ Frontend Environment (Yarn PnP)
     ↓ (state regeneration)
 Test Execution (all phases)
     ↓ (consistent Docker approach)
+Runtime Black-Box Integration
+    ↓ (deployable backend tag+digest verification)
 E2E Testing (Playwright)
     ↓ (Chromium + network resilience)
 ✅ SUCCESS

docs/DEPLOYABLE_RUNTIME_CONTRACT.md

@@ -31,7 +31,7 @@ Excluded:
 
 - Container build source: `Dockerfile.backend`.
 - Runtime base image: `python:3.14-slim`.
-- Runtime process: `uvicorn main:app --host 0.0.0.0 --port 8000`.
+- Runtime process: `uvicorn backend.main:app --app-dir /app/src --host 0.0.0.0 --port 8000`.
 - Exposed runtime port: `8000`.
 
 ### Required Runtime Dependencies
@@ -68,7 +68,7 @@ The lockfile in `backend/uv.lock` is the dependency source of truth.
 ### Backend Runtime Checklist
 
 - [ ] Runtime image built from `Dockerfile.backend`.
-- [ ] Runtime process is uvicorn serving `main:app` on `0.0.0.0:8000`.
+- [ ] Runtime process is uvicorn serving `backend.main:app` with app dir `/app/src` on `0.0.0.0:8000`.
 - [ ] `DATABASE_URL` is set in deployment runtime.
 - [ ] `GET /health` behavior matches contract.
 - [ ] Startup fails on runtime policy mismatch.
@@ -157,6 +157,12 @@ Current enforcement implemented in CI:
   - Workflow: `.gitea/workflows/docker-build-main.yaml`
   - Checks include binary presence and profile-specific package metadata probes
     to detect CI/development tooling leakage.
+- Runtime black-box integration checks against deployed backend container:
+  - Workflow: `.gitea/workflows/cicd-tests.yaml` (`integration-tests` job)
+  - Inputs: deployable backend commit tag reference and immutable digest
+    reference from main build dispatch.
+  - Assertions: digest/tag consistency and live endpoint behavior for `/`,
+    `/compatibility`, and `/health` on started runtime containers.
 
 Future follow-up automation under epic #66 may expand this with: