ci: verify isolated Docker news journeys before merging to main

.gitea/workflows/ci.yaml

@@ -2,7 +2,7 @@ name: CI
 
 on:
   push:
-    branches: [main, master]
+    branches: [main, master, "codex/**"]
     tags: ["v*"]
   pull_request:
     branches: [main, master]
@@ -79,6 +79,36 @@ jobs:
             test-results/ui/
           retention-days: 14
 
+  # Validate branch/PR Docker images before integration into a deployment branch.
+  preflight:
+    needs: check
+    if: gitea.event_name == 'pull_request' || (gitea.event_name == 'push' && startsWith(gitea.ref, 'refs/heads/codex/'))
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ gitea.repository }}
+          token: ${{ gitea.token }}
+
+      - name: Toolchain check
+        run: node scripts/check-node-toolchain.mjs
+
+      - name: Build and verify isolated candidate
+        shell: bash
+        run: bash scripts/ci-preflight.sh
+
+      - name: Upload preflight news browser results
+        if: always()
+        uses: https://gitea.com/actions/gitea-upload-artifact@62ac910c5d3dfa85c7cb2df15afe2e342b2407c2
+        with:
+          name: preflight-news-browser-results
+          path: |
+            test-results/news-real/
+            playwright-report/news-real/
+          if-no-files-found: warn
+          retention-days: 14
+
   # ─────────────────────────────────────────────
   # Docker build & deploy
   # Draait op de host (self-hosted) zodat Docker