fix(ci): draai alle jobs op self-hosted voor 100% betrouwbaarheid

Root cause: de job-container (docker mode) heeft GEEN outbound
internet naar GitHub, waardoor actions/checkout@v4 faalde met
'Unable to clone ... i/o timeout'.

Oplossing: zowel check als deploy draaien nu op self-hosted (host)
waar Node 26.8.1 + pnpm 11.25.0 geïnstalleerd zijn en internet
beschikbaar is. Dit is de enige betrouwbare setup in deze omgeving.
Runner is tevens hernoemd naar 'Epic runner'.

.gitea/workflows/ci.yaml

@@ -11,10 +11,13 @@ on:
 jobs:
   # ─────────────────────────────────────────────
   # Lint, typecheck & unit tests
-  # Draait in een node:26 container op de Epic runner
+  # Draait op de host (self-hosted) waar Node 26 +
+  # pnpm 11 geïnstalleerd zijn en internet beschikbaar is.
+  # De job-container (docker mode) heeft GEEN outbound
+  # internet, dus we draaien alles direct op de host.
   # ─────────────────────────────────────────────
   check:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -22,10 +25,8 @@ jobs:
           repository: ${{ gitea.repository }}
           token: ${{ gitea.token }}
 
-      - name: Setup pnpm
+      - name: Toolchain check
-        run: |
+        run: node scripts/check-node-toolchain.mjs
-          corepack enable
-          corepack prepare [email protected] --activate
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile --jobs 1

src/lib/ci-workflow-contract.test.ts

@@ -28,17 +28,21 @@ describe("CI workflow", () => {
 		expect(workflow).toContain("pnpm test");
 	});
 
-	it("deploy uses self-hosted runner", () => {
+	it("check job runs on self-hosted runner", () => {
-		expect(workflow).toContain("runs-on: self-hosted");
+		const checkJob = workflow.slice(
+			workflow.indexOf("check:"),
+			workflow.indexOf("\n  deploy:"),
+		);
+		expect(checkJob).toContain("runs-on: self-hosted");
 	});
 
-	it("check uses ubuntu-latest runner", () => {
+	it("deploy job runs on self-hosted runner", () => {
-		expect(workflow).toContain("runs-on: ubuntu-latest");
+		const deployJob = workflow.slice(workflow.indexOf("\n  deploy:"));
+		expect(deployJob).toContain("runs-on: self-hosted");
 	});
 
-	it("installs pnpm via corepack", () => {
+	it("check includes toolchain check", () => {
-		expect(workflow).toContain("corepack enable");
+		expect(workflow).toContain("scripts/check-node-toolchain.mjs");
-		expect(workflow).toContain("corepack prepare [email protected]");
 	});
 
 	it("does not use github context", () => {

src/lib/deploy-workflow-contract.test.ts

@@ -14,6 +14,10 @@ describe("deploy job", () => {
 		expect(deployJob).toContain("runs-on: self-hosted");
 	});
 
+	it("has checkout step", () => {
+		expect(deployJob).toContain("actions/checkout@v4");
+	});
+
 	it("builds Docker image with BuildKit", () => {
 		expect(deployJob).toContain("DOCKER_BUILDKIT=1");
 		expect(deployJob).toContain("docker build");