The CI-contract test now checks the Gitea workflow smokes the Maven final jar (the orb .qqq-ci.yml is gone). The release-bundle test renders compose.yaml with docker compose config, so CI installs a checksum-pinned Compose binary behind a docker compose-only shim. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>