Fix fidelity job: reach sidecars via shared netns, not ip (#69)

The runner image has no iproute2, so `ip -4 route` failed (exit 127) and the
readiness curl never got a gateway — the job died before the tests ran.
Attach the pandoc/Gotenberg sidecars to the job container's own network
namespace (`--network container:$(cat /etc/hostname)`) and reach them at
localhost, dropping the `ip`/host-gateway plumbing and published ports.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1

.gitea/workflows/ci.yml

@@ -377,34 +377,34 @@ jobs:
         run: pnpm --filter @dorfteich/api exec prisma generate
 
       # Start the pinned sidecars with `docker run` (pandoc-server needs the
-      # `server` arg, which Actions `services:` cannot pass). Their published
-      # ports are reached from this job container via the Docker host gateway —
-      # robust regardless of the runner's per-job network name. Uncommon host
-      # ports avoid colliding with anything else on the runner.
+      # `server` arg, which Actions `services:` cannot pass) and attach them to
+      # THIS job container's network namespace, so they are reachable at
+      # localhost — no dependency on `ip`/gateway routing (the minimal runner
+      # image has no iproute2). Sharing the netns means no published ports.
       - name: Start pinned pandoc + Gotenberg sidecars
         run: |
           # Clear any leftovers from an earlier interrupted run so the named
           # containers never collide, and nothing leaks on the shared host.
           docker rm -f fidelity-pandoc fidelity-gotenberg 2>/dev/null || true
-          docker run -d --name fidelity-pandoc -p 13030:3030 pandoc/core:3.6 server
-          docker run -d --name fidelity-gotenberg -p 13000:3000 gotenberg/gotenberg:8
-          GW=$(ip -4 route show default | awk '{print $3; exit}')
-          echo "SIDECAR_HOST=$GW" >> "$GITHUB_ENV"
+          JOB_ID=$(cat /etc/hostname)
+          docker run -d --name fidelity-pandoc \
+            --network "container:${JOB_ID}" pandoc/core:3.6 server
+          docker run -d --name fidelity-gotenberg \
+            --network "container:${JOB_ID}" gotenberg/gotenberg:8
           for i in $(seq 1 30); do
-            curl -sf "http://$GW:13030/version" >/dev/null && break
+            curl -sf http://localhost:3030/version >/dev/null && break
             sleep 1
           done
           for i in $(seq 1 30); do
-            curl -sf "http://$GW:13000/health" >/dev/null && break
+            curl -sf http://localhost:3000/health >/dev/null && break
             sleep 1
           done
-          curl -sf "http://$GW:13030/version"
-          curl -sf "http://$GW:13000/health"
+          curl -sf http://localhost:3030/version
+          curl -sf http://localhost:3000/health
 
       - name: Run fidelity suite (import + export snapshots, PDF smoke)
         run: |
-          PANDOC_URL="http://${SIDECAR_HOST}:13030" \
-          GOTENBERG_URL="http://${SIDECAR_HOST}:13000" \
+          PANDOC_URL=http://localhost:3030 GOTENBERG_URL=http://localhost:3000 \
             pnpm --filter @dorfteich/api exec vitest run \
               src/import-export/import.fixtures.test.ts \
               src/import-export/export.fidelity.test.ts \