Cold-start CI gate: boot the public compose stack and drive the real first-run journey

[pratikbodkhe]

Why

CI has never executed the artifact self-hosters actually run: docker compose up from a clean checkout. Every self-host show-stopper so far (migrations never applied, Kong key substitution dead, missing storage role grants, fresh seed with no admin) lived in exactly that blind spot while all 16 supabase start E2E shards stayed green. This closes the class of bug most likely to kill an OSS launch: "I tried it and it didn't even start."

What

• New cold-start CI job: generates .env non-interactively, runs docker compose up -d --build on the real public compose file, waits for db/auth/rest/storage health, then drives the journey.
• playwright.cold-start.config.ts + e2e/cold-start/cold-start.spec.ts: one serial browser session walking the /setup wizard through the real UI (setup token, admin creation, instance config, demo seed), then the golden path as that admin: onboarding wizard, seeded demo data on the OIL board, series create, first meeting start, live issue capture, reload persistence, admin health, and the setup-guard inversion.
• scripts/wait-for-cold-start-stack.sh: readiness poll over /api/setup/check-env plus /api/admin/health (storage), setup-token authed.
• Verifier block in verify-self-host-migrations.test.mjs fails CI if the gate is ever unwired (env-before-build ordering, wait script, config, log capture).
• Main Playwright config excludes e2e/cold-start/ (its wizard walk cannot pass on the seeded supabase start stack).

Deliberate choices

• The job runs literally docker compose up -d --build with no layer cache. Fidelity is the point: a cached/bake-based pipeline is not the build a stranger runs, and the baked-at-build-time NEXT_PUBLIC_* args trap is only caught by the plain path. ~12 min per run, in budget next to the 16 e2e shards.
• Setup token and generated keys are masked in job logs; all values are per-run ephemera destroyed by docker compose down -v.

Verification

• 5/5 journey green against repeated genuine cold boots locally (fresh volumes each time).
• test:self-host 9/9, test:ci-workflows, test:oss-boundaries, lint 0 errors.
• Full local regression: 596 passed; the 13 failures are the documented local-env set (JST/email/service-role env, workers=4 seed-role collisions), none in files this diff touches.