Stabilize self-hosted CI workflows and resolve issue #62 (#73)

## Summary

Hardens CI workflows for self-hosted Gitea runners by stabilizing E2E execution and Renovate behavior across internal/external network paths.

Closes #62

## What Changed

### E2E workflow reliability
- Fixed E2E workspace handoff to ensure expected repository contents are present during test execution.
- Added stricter preflight checks for required frontend files before running E2E.
- Reduced mount/path fragility while preserving runtime image pull and compose flow.

### Renovate workflow hardening
- Added internal-first endpoint reachability selection with fallback handling.
- Added token preflight checks for repository access.
- Added explicit host-rule auth handling for API/git paths.
- Added container-level connectivity preflight diagnostics.
- Added git URL override aligned with selected endpoint context.
- Removed incorrect forced Dogar host-IP pinning that broke HTTPS clone routing.

## Why

CI behavior was sensitive to runner networking and Renovate clone/auth interactions. These changes make the workflow deterministic in our runner topology and address recurring CI failures.

## Scope

- Workflow logic only (`cicd.yaml`, `renovate.yml`)
- No app feature or API behavior changes

## Validation

- Workflow YAML validation passed during updates.
- Changes were applied and verified iteratively from real failing run diagnostics.

Co-authored-by: copilotcoder <copilotcoder@darkhelm.org>
Reviewed-on: #73

docs/DEPLOYABLE_RUNTIME_CONTRACT.md

@@ -30,6 +30,7 @@ Excluded:
 ### Runtime Artifact Definition
 
 - Container build source: `Dockerfile.backend`.
+- Build shape: two-stage build with a dependency stage and a minimal runtime stage.
 - Runtime base image: `python:3.14-slim`.
 - Runtime process: `uvicorn backend.main:app --app-dir /app/src --host 0.0.0.0 --port 8000`.
 - Exposed runtime port: `8000`.
@@ -79,6 +80,7 @@ The lockfile in `backend/uv.lock` is the dependency source of truth.
 ### Frontend Runtime Artifact Definition
 
 - Container build source: `Dockerfile.frontend` (target `production`).
+- Build shape: two-stage build with a dependency/build stage and a minimal nginx runtime stage.
 - Runtime base image: `nginx:alpine`.
 - Runtime process: `nginx -g "daemon off;"`.
 - Exposed runtime port: `80`.
@@ -151,14 +153,14 @@ Current enforcement implemented in CI:
 
 - Dockerfile target boundary checks:
   - Script: `scripts/check-dockerfile-boundaries.sh`
-  - Workflow: `.gitea/workflows/docker-build-main.yaml`
+  - Workflow: `.gitea/workflows/cicd.yaml`
 - Deployable runtime image purity checks:
   - Script: `scripts/verify-deployable-image-purity.sh`
-  - Workflow: `.gitea/workflows/docker-build-main.yaml`
+  - Workflow: `.gitea/workflows/cicd.yaml`
   - Checks include binary presence and profile-specific package metadata probes
     to detect CI/development tooling leakage.
 - Runtime black-box integration checks against deployed backend container:
-  - Workflow: `.gitea/workflows/cicd-tests.yaml` (`integration-tests` job)
+  - Workflow: `.gitea/workflows/cicd.yaml` (`integration-tests` job)
   - Inputs: deployable backend commit tag reference and immutable digest
     reference from main build dispatch.
   - Assertions: digest/tag consistency and live endpoint behavior for `/`,