fix(apps): reconcile goldens to one canonical render + enforce render==golden gate

The committed apps/ goldens were a MIX of two render flag sets: 8 services
were rendered with `--no-image-automation` (no image CRs) while gitea and
nextcloud carried stale ImageRepository/ImagePolicy CRs from a render WITHOUT
the flag. Neither single command reproduced all goldens, and the gate did not
catch it.

Part A — canonical render:
  python3 catalog/render.py --all catalog -o apps --wave-layout --no-image-automation
`--no-image-automation` is canonical: image automation is authored-but-DISABLED
(DECISIONS-LOG; image-reflector/-automation controllers not installed), and
every app was onboarded via this flag. Re-render drops the ImageRepository +
ImagePolicy objects from gitea + nextcloud only (52 line deletions, purely the
trailing image-automation blocks). No functional content changed — the
nextcloud postStart hardening and gitea OIDC hook are untouched.

Part B — enforcement:
  ci/render-golden.sh renders every onboarded catalog service with the canonical
  command into a temp dir and FAILS on ANY diff vs committed apps/ (missing
  golden or content drift), across all 10 services (not just the 3 L1 spot-checks).
  Not-onboarded catalog entries (keycloak, vm-demo) are excluded per DESIGN-waves.
  Wired as a required no-cluster stage in ci/gate.sh, ci/Makefile, and both the
  live (.gitea/workflows/gate.yml) and dormant (merge-gate.yaml) pipelines.

Proof: tampering a golden makes the stage exit 1 (blocks merge); reverting
restores exit 0. `make -C ci gate` green in the devcontainer.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

.gitea/workflows/README.md

@@ -15,8 +15,8 @@ it touches is green** (R-TEST-03).
 ## The pipeline
 
 ```
- lint ─▶ l0 (schema + Kyverno) ─▶ l1 (rendering) ─▶ conformance (L2/L3) ─▶ merge-gate decision
- └────────── run in CI, NO cluster ──────────┘        └── in-cluster Chainsaw Job ──┘
+ lint ─▶ l0 (schema + Kyverno) ─▶ render-golden ─▶ l1 (rendering) ─▶ conformance (L2/L3) ─▶ merge-gate decision
+ └──────────────── run in CI, NO cluster ────────────────┘        └── in-cluster Chainsaw Job ──┘
                     live now                              cluster-gated (SKIPS in Phase 0)
 ```
 

.gitea/workflows/gate.yml

@@ -3,8 +3,9 @@
 # This is the LIVE gate wired to the in-cluster Gitea Actions runner (ns gitea-actions,
 # Docker executor + DinD). It runs the STATIC layers of the conformance gate — the ones
 # docs/14 says run "without a cluster": spec-immutability (best-effort), lint, Kyverno L0,
-# and L1 offline render checks. It is the single required status check on `main`
-# (see branch protection). `make -C ci lint l0 l1` here is byte-identical to a laptop run
+# the render==golden reproducibility check, and L1 offline render checks. It is the single
+# required status check on `main`
+# (see branch protection). `make -C ci lint l0 render-golden l1` here is byte-identical to a laptop run
 # (R-TEST-02) — the runner just installs the pinned tools from ci/versions.env first.
 #
 # The L2/L3 CONFORMANCE layer (behavioural + fault-injection, needs a live cluster) is
@@ -57,8 +58,8 @@ jobs:
       - name: Spec immutability (R-TEST-06, skips if spec repo absent)
         run: ./ci/spec-immutability.sh || [ "$?" -eq 3 ]
 
-      - name: Static gate — lint + Kyverno L0 + L1 render
-        run: make -C ci lint l0 l1
+      - name: Static gate — lint + Kyverno L0 + render==golden + L1 render
+        run: make -C ci lint l0 render-golden l1
 
       # NOTE: no actions/upload-artifact step. Gitea Actions rejects upload-artifact@v4
       # ("not supported on GHES" — Gitea does not implement the artifact-v2 backend), which

.gitea/workflows/merge-gate.yaml

@@ -3,7 +3,7 @@
 # platform. Enforces docs/14 (Testing & Conformance) gating rules as Gitea Actions.
 #
 # Pipeline (docs/14 "Where each layer runs"):
-#   lint  ->  schema  ->  kyverno-L0  ->  L1-render        [no cluster; live now]
+#   lint  ->  schema  ->  kyverno-L0  ->  render==golden  ->  L1-render   [no cluster; live now]
 #                                          |
 #                                          v
 #                            conformance-L2-L3 (in-cluster Chainsaw Job)
@@ -89,9 +89,20 @@ jobs:
       - name: Schema validation + Kyverno L0
         run: make -C ci l0
 
-  l1:
+  render-golden:
     runs-on: ubuntu-latest
     needs: [l0]
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+      - name: Install pinned tools
+        run: ./.gitea/workflows/scripts/install-tools.sh l1
+      - name: render==golden reproducibility (canonical render vs committed apps/)
+        run: make -C ci render-golden
+
+  l1:
+    runs-on: ubuntu-latest
+    needs: [render-golden]
     steps:
       - uses: actions/checkout@v4
         with: { fetch-depth: 0 }
@@ -143,7 +154,7 @@ jobs:
   #   conformance skipped + no cluster        -> report UNVERIFIED (Phase 0), do not fake green
   merge-gate:
     runs-on: ubuntu-latest
-    needs: [lint, l0, l1, conformance]
+    needs: [lint, l0, render-golden, l1, conformance]
     if: always()
     steps:
       - uses: actions/checkout@v4