Stability checkpoint — integration-tests CI re-enabled + auto-merge dev→main shipped

- feat(ci): include auto-merge-dev-to-main template (iris-common)
- feat(ci): re-enable integration-tests via SaaS Linux runner (saas-linux-medium-amd64)
- fix(ci): switch kafka -> redpanda (boot ~3-5s vs kafka KRaft >30s)
- ci: GitHub Actions mirror workflow for integration-tests (Linux amd64 native)

CI :
- ✅ Main pipeline #2514037064 green (post-promote dev→main, includes redpanda fix)
- ✅ All validate gates (ruff, mypy, import-linter, pip-audit, docs:check, shellcheck, adr-drift, conv-commits)
- ✅ unit-tests + benchmarks
- ✅ integration-tests : 18 passed, 1 minor flake on aiokafka client teardown (deterministic on retry)
- ✅ promote-dev-to-main job : auto-pushes dev to main on green dev pipeline

GitHub Actions :
- 🆕 First run live (run #25637713122) — mirror integration-tests on ubuntu-latest with services postgres + bitnamilegacy/kafka

Local test pass :
- ⏭ uv run pytest : not re-validated this rev (CI gates confirm)
- ⏭ uv run pip-audit : 0 CVEs (gate green in CI)

Regression check vs previous tag :
- ✅ All v0.7.3 known limitations still bounded :
  - Docker image alpine 412 MB still blocked (musl wheels for cryptography)
  - integration-tests scope-out — NOW LIFTED (this tag) ✅
- 🆕 New limitation : GitLab CI integration-tests routes to SaaS (~400 free min/mo). Local
  runner not yet support — debug attempts documented in
  docs/audit/runner-dind-migration-2026-05-09.md +
  docs/audit/kafka-ci-redpanda-switch-2026-05-10.md

- ⏭ N/A — no AI/ML code change in this rev

- pip-audit : 0 CVEs (still green from v0.7.3 fixes)
- AUTOMERGE_TOKEN : Personal Access Token (write_repository scope, expires 2027-05-10), masked + protected at iris-7 group level
- Branch protection : dev now protected on all 5 iris repos with allow_force_push for the AUTOMERGE_TOKEN user (Owner)

- ⏭ N/A — CI/release-engineering rev, no domain feature

- ⏭ N/A

- ⏭ N/A

- ruff format + ruff:lint : green
- mypy strict : green
- import-linter : green
- docs:check : green
- pip-audit : 0 CVEs
- 🆕 integration-tests : real gate again (was scope-out in v0.7.3)
- Coverage : ≥90% (gate enforced via pyproject.toml addopts)

- 🆕 Auto-merge dev → main template (iris-common ci-templates/auto-merge-dev-to-main.yml)
  - Skips when dev is already ancestor of main
  - Force-with-lease on divergence
  - Requires AUTOMERGE_TOKEN group var + main branch protection allow_force_push
- 🆕 Kafka switch to redpanda (faster CI cluster bootstrap)
- 🆕 SaaS routing for integration-tests (saas-linux-medium-amd64 tag)
- 🆕 GitHub Actions mirror workflow (ubuntu-latest, services postgres + kafka)
- workflow:rules now matches dev branch (was main-only)

- iris-common SHA pinned at 8e8eabd (cf. java + ui)
- Template-driven CI : 4 universal templates from iris-common
  (shellcheck, adr-drift, conv-commits, auto-merge-dev-to-main)
- Audit doc pattern : docs/audit/*.md per major investigation

- ⏭ N/A — backend repo

- 141 stale local + remote branches cleaned (this session)
- Auto-merge dev → main = no more manual promote MRs
- GitHub mirror as backup / portfolio surface

- **integration-tests on GitLab CI**: routes to SaaS (free quota ~400 min/month).
  Local runner attempts (5 approaches tried 2026-05-09→10) all hit kafka KRaft
  bootstrap >30s timeout. Re-attempt local-only later as separate effort.
- **Docker image alpine** : 412 MB → ~280 MB possible. Blocked: pydantic_core /
  cryptography / bcrypt have no musl wheels.

- Re-test local-only integration-tests with redpanda image (unblocked the fundamental issue)
- pin iris-common SHA bump after next iris-common rev