ci: Sprint 04 — CI/CD reliability (BuildKit docs, cache-to, version pins, cleanup, compose validation)

- Document DOCKER_BUILDKIT=0 rationale in all deploy workflows
- Add --cache-to type=inline to all docker build commands
- Pin Python 3.12 and Node 20 with version assertions in CI
- Remove dead test-summary job from test.yml
- Reconcile required-tools.txt with Dockerfile.base (bash, ca-certificates, openssh-client)
- Clean up stale artifacts (Dockerfile comment, orphaned .md files)
- Add docker-compose config validation before claude-dev deploy

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/test.yml

@@ -9,6 +9,19 @@ on:
   workflow_dispatch:
 
 jobs:
+  gitleaks:
+    name: Secret Detection
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run gitleaks
+        run: |
+          docker run --rm -v "$(pwd):/src" -w /src zricethezav/gitleaks:latest detect --source . --config-path .gitleaks.toml --verbose
+
   backend-tests:
     name: Backend Tests
     runs-on: ubuntu-latest
@@ -24,6 +37,7 @@ jobs:
       - name: Setup Python
         run: |
           python3 --version
+          python3 -c "import sys; assert sys.version_info[:2] == (3, 12), f'Expected Python 3.12, got {sys.version}'; print('Python 3.12 confirmed')"
           pip3 --version
 
       - name: Cache Python dependencies
@@ -118,6 +132,7 @@ jobs:
       - name: Setup Node.js
         run: |
           node --version
+          node -e "assert(process.version.startsWith('v20'), 'Expected Node 20, got ' + process.version); console.log('Node 20 confirmed')"
           npm --version
 
       - name: Cache Node dependencies
@@ -169,21 +184,3 @@ jobs:
             exit 1
           fi
           echo "✅ Frontend tests passed"
-
-  test-summary:
-    name: Test Summary
-    runs-on: ubuntu-latest
-    needs: [backend-tests, frontend-tests]
-    if: always()
-
-    steps:
-      - name: Check job results
-        run: |
-          echo "Backend tests: ${{ needs.backend-tests.result }}"
-          echo "Frontend tests: ${{ needs.frontend-tests.result }}"
-
-          if [ "${{ needs.backend-tests.result }}" != "success" ] || [ "${{ needs.frontend-tests.result }}" != "success" ]; then
-            echo "❌ Some tests failed"
-            exit 1
-          fi
-          echo "✅ All tests passed"