ci: single Gitea Actions pipeline, uv-based image, scoped docker cleanup

Replace lint/test/docker workflows with ci.yml (gitleaks, lint, test-unit, test-integration, test-mcp, build-and-push, docs-check, security). Rebuild the Dockerfile as a digest-pinned multi-stage uv build running as uid 1000, add .dockerignore, a hardened compose file and a gitleaks config. The integration harness now falls back to /etc/hostname and /proc/self to find its own container.

tests/integration/test_harness.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+from pathlib import Path
+
 import pytest
 
 from tests.integration import harness
@@ -138,3 +140,20 @@ def test_missing_docker_cli_gives_clear_error(monkeypatch: pytest.MonkeyPatch) -
     monkeypatch.setenv("PATH", "")
     with pytest.raises(HarnessError, match="Docker is unavailable"):
         harness.require_docker()
+
+
+def test_container_id_candidates_fall_back_to_proc(tmp_path: Path) -> None:
+    cid = "ab" * 32
+    (tmp_path / "etc").mkdir()
+    (tmp_path / "proc/self").mkdir(parents=True)
+    (tmp_path / "etc/hostname").write_text("custom-host\n")
+    (tmp_path / "proc/self/mountinfo").write_text(
+        f"1 2 0:1 /var/lib/docker/containers/{cid}/hostname /etc/hostname rw - ext4 /dev/x rw\n"
+    )
+    (tmp_path / "proc/self/cgroup").write_text(f"0::/docker/{cid}\n")
+    candidates = harness.container_id_candidates({"HOSTNAME": "job-host"}, proc_root=tmp_path)
+    assert candidates == ["job-host", "custom-host", cid]
+
+
+def test_container_id_candidates_tolerate_missing_files(tmp_path: Path) -> None:
+    assert harness.container_id_candidates({}, proc_root=tmp_path) == []