ci: fix E2E db target guard and strip bind mounts in docker deploy test

E2E was failing at `pnpm db:push` because scripts/prisma-with-env.mjs
refuses to run when DATABASE_URL's database name doesn't match the
expected target ("capakraken"). CI uses capakraken_test. Set
CAPAKRAKEN_EXPECTED_DB_NAME=capakraken_test on the e2e job.

Fresh-Linux Docker Deploy was failing because docker-compose.yml's dev
bind mount `.:/app` doesn't work under docker-outside-of-docker on the
Gitea act_runner — the host daemon can't see the job container's
/workspace/... path, so the mount masks the image's baked-in files and
the CMD fails with `cannot open ./tooling/docker/app-dev-start.sh`.
Added docker-compose.ci.yml that resets `app.volumes` and layered it
onto every `docker compose` invocation in the deploy job.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -303,6 +303,9 @@ jobs:
           --health-retries=5
     env:
       DATABASE_URL: postgresql://capakraken:capakraken_test@postgres:5432/capakraken_test
+      # prisma-with-env.mjs refuses to run unless DATABASE_URL's db name matches
+      # the expected target; default is "capakraken", CI uses capakraken_test.
+      CAPAKRAKEN_EXPECTED_DB_NAME: capakraken_test
       ALLOW_DESTRUCTIVE_DB_TOOLS: "true"
       CONFIRM_DESTRUCTIVE_DB_NAME: capakraken_test
       REDIS_URL: redis://redis:6379
@@ -382,17 +385,17 @@ jobs:
           EOF
 
       - name: Start infrastructure (postgres + redis)
-        run: docker compose up -d postgres redis
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml up -d postgres redis
 
       - name: Wait for postgres
         run: |
           for i in $(seq 1 20); do
-            docker compose exec -T postgres pg_isready -U capakraken -d capakraken && break
+            docker compose -f docker-compose.yml -f docker-compose.ci.yml exec -T postgres pg_isready -U capakraken -d capakraken && break
             sleep 3
           done
 
       - name: Build and start app (full profile)
-        run: docker compose --profile full up -d --build app
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml --profile full up -d --build app
 
       - name: Wait for /api/health (up to 3 minutes)
         run: |
@@ -403,7 +406,7 @@ jobs:
             sleep 5
           done
           echo "Health check timed out"
-          docker compose logs app --tail=50
+          docker compose -f docker-compose.yml -f docker-compose.ci.yml logs app --tail=50
           exit 1
 
       - name: Verify health response contains status ok
@@ -414,7 +417,7 @@ jobs:
 
       - name: Seed admin user
         run: |
-          docker compose exec -T app node /app/scripts/setup-admin.mjs \
+          docker compose -f docker-compose.yml -f docker-compose.ci.yml exec -T app node /app/scripts/setup-admin.mjs \
             --email admin@capakraken.dev \
             --name "Admin" \
             --password admin123
@@ -443,7 +446,7 @@ jobs:
 
       - name: Show logs on failure
         if: failure()
-        run: docker compose logs --tail=100
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml logs --tail=100
 
   # ──────────────────────────────────────────────
   # Release images — only on push to main, after

docker-compose.ci.yml

@@ -0,0 +1,15 @@
+# CI override for docker-deploy-test.
+#
+# The dev compose bind-mounts `.:/app` so edits are live during `pnpm dev`.
+# Under act_runner (docker-outside-of-docker on Gitea), the host docker
+# daemon cannot see the job container's /workspace/... path, so the bind
+# mount resolves to an empty directory inside the app container and masks
+# everything the Dockerfile copied in — including tooling/docker/app-dev-start.sh.
+#
+# Result: `sh: cannot open ./tooling/docker/app-dev-start.sh: No such file`.
+#
+# This override strips all bind mounts from the `app` service so the image
+# runs against its baked-in copy of the repo.
+services:
+  app:
+    volumes: !reset []