ci: secs4j-interop bootstrap resilient to runner image variant

CI log showed:
  Run export DEBIAN_FRONTEND=noninteractive
  apt-get: command not found
  Failure - Main Bootstrap (node + git)
  exit status 127

The secs4j-interop job runs on the bare runner (not inside a
`container:`) because it needs the host's docker socket to run
`docker compose up -d server`.  The runner image isn't fixed across
deployments — catthehacker/ubuntu has apt-get, but a minimal node
image doesn't.  The old script hard-coded `apt-get` and exit 127'd
on anything else.

New bootstrap:
- Checks what's already on PATH (git, node, docker).  If all three
  are present, exits 0 — most act-runner images come pre-loaded.
- Otherwise picks the right package manager (apt-get or apk) and
  installs only the missing pieces.
- Errors out with a useful message if neither package manager
  exists, instead of failing on a missing command.

Also updates the inline comment that still said "20 checks" — actual
is 55 (matches the count in README / PROOFS.md / COMPLIANCE.md).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -125,21 +125,54 @@ jobs:
   secs4j-interop:
     runs-on: ubuntu-latest
     # secs4j-interop builds its own docker image (with JDK) and starts
-    # secs_server via docker compose; needs the docker socket.
+    # secs_server via docker compose; needs the docker socket, which
+    # is why this job runs on the bare runner rather than inside a
+    # `container:` like the other jobs.
+    #
+    # The bare runner image varies across deployments — catthehacker
+    # provides apt-get, but some gitea-act runners use a minimal node
+    # image with no package manager.  The bootstrap step detects what
+    # it has (apt-get / apk / nothing) and only installs missing
+    # pieces; node + git are usually already present so actions/checkout
+    # can run.
     steps:
-      - name: Bootstrap (node + git)
+      - name: Bootstrap (node + git + docker CLI if missing)
         run: |
+          set -e
+          need_git=0; need_node=0; need_docker=0
+          command -v git    >/dev/null || need_git=1
+          command -v node   >/dev/null || need_node=1
+          command -v docker >/dev/null || need_docker=1
+          if [ "$need_git$need_node$need_docker" = "000" ]; then
+            echo "runner image already has git/node/docker — skipping install"
+            exit 0
+          fi
+          if command -v apt-get >/dev/null; then
             export DEBIAN_FRONTEND=noninteractive
             apt-get update
-          apt-get install -y --no-install-recommends \
-            git ca-certificates nodejs docker.io docker-compose-plugin
+            pkgs=""
+            [ "$need_git"    = "1" ] && pkgs="$pkgs git ca-certificates"
+            [ "$need_node"   = "1" ] && pkgs="$pkgs nodejs"
+            [ "$need_docker" = "1" ] && pkgs="$pkgs docker.io docker-compose-plugin"
+            apt-get install -y --no-install-recommends $pkgs
+          elif command -v apk >/dev/null; then
+            pkgs=""
+            [ "$need_git"    = "1" ] && pkgs="$pkgs git ca-certificates"
+            [ "$need_node"   = "1" ] && pkgs="$pkgs nodejs"
+            [ "$need_docker" = "1" ] && pkgs="$pkgs docker docker-cli-compose"
+            apk add --no-cache $pkgs
+          else
+            echo "no apt-get or apk — runner image has no package manager"
+            echo "need: git=$need_git node=$need_node docker=$need_docker"
+            exit 1
+          fi
 
       - uses: actions/checkout@v4
 
       # Cross-validate against secs4java8 (Apache 2.0, kenta-shimizu) —
-      # an independent SECS implementation in Java.  20 checks
-      # covering S1/S2/S3/S5/S14/S16 with full-body GEM 300 shapes
-      # that secsgem-py couldn't easily drive.
+      # an independent SECS implementation in Java.  55 checks
+      # covering S1/S2/S3/S5/S6/S7/S10/S14/S16 with full-body GEM 300
+      # shapes that secsgem-py couldn't easily drive.
       - name: secs4j cross-validation
         run: bash interop/secs4j_validate.sh