build.yml: run the hermetic suite inside the built image (promote dev's port to main, matching the split repos' dev->main promotion)

.forgejo/workflows/build.yml

@@ -1,6 +1,6 @@
 name: Build check (reusable)
 
-# Build-only `docker build` sanity check for ONE app domain, reused via
+# `docker build` + in-image test check for ONE app domain, reused via
 # `uses:` by pr-build.yml and the deploy-dev workflows -- the monorepo port of
 # each app repo's build.yml. Still deliberately NOT a live boot+healthz check:
 # that was tried in the split repos and repeatedly hit this runner's own
@@ -34,3 +34,25 @@ jobs:
 
       - name: Build
         run: docker build -t thermograph-${{ inputs.domain }}:ci ${{ inputs.domain }}/
+
+      # Run the hermetic test tier INSIDE the image we just built (each image
+      # ships tests/ + every runtime dep via COPY . /app/): the exact
+      # interpreter/deps that ship, none of the runner-environment quirks that
+      # sank the old host-side boot check. Backend runs its full (hermetic)
+      # suite; frontend runs only its unit tier -- its integration tier
+      # (frontend/tests/integration/, needs a live backend container) stays a
+      # local `make`/scripts concern, see frontend/scripts/backend-for-tests.sh.
+      # requirements-dev only layers pytest on top, so the install is tiny.
+      # -u 0: the images' default user can't write to site-packages.
+      # --entrypoint sh: backend's entrypoint is alembic-migrate + uvicorn --
+      # without the override the test command is swallowed as entrypoint args
+      # and the container just boots the server forever (harmless no-op for
+      # frontend, which has no entrypoint). unset THERMOGRAPH_BASE: the images
+      # bake the prod root-mount (/), which moves every route off the
+      # /thermograph prefix the tests are written against.
+      - name: Run tests in the built image
+        run: |
+          target=tests
+          if [ "${{ inputs.domain }}" = "frontend" ]; then target=tests/unit; fi
+          docker run --rm -u 0 --entrypoint sh thermograph-${{ inputs.domain }}:ci \
+            -c "unset THERMOGRAPH_BASE; pip install -q --no-cache-dir pytest==8.4.1 && python -m pytest $target -q"