What

Adds a CI-only integration harness that executes compose2pod's output against real podman, closing the gap where every existing test only asserts on the generated script's text. See the design in planning/changes/2026-07-12.04-integration-harness.md.

The harness renders a compose doc via the public emit_script, runs the generated run.sh to completion, and asserts behaviorally on exit code + captured output. Assertions are behavioral (not live podman exec/inspect) because the generated script self-destructs its pod via trap EXIT and runs the target in the foreground under set -eu — so a clean exit already proves pod creation, dependency startup, service_healthy gating, completion-gating, and a passing target probe.

Seed scenarios (behavioral probes, built to grow)

• Healthy-gating — postgres (pg_isready healthcheck) + an app reaching it over the pod-shared 127.0.0.1:5432.
• Completion-gating — a one-shot writes a flag to a shared bind mount after a delay; the target reads it, so exit 0 fails if the gate regresses to a backgrounded run.
• Bind volume — a sentinel file mounted via a short-form relative bind, read back inside the container.

Isolation from the fast suite and the 100% gate

• An integration marker applied by a tryfirst pytest_collection_modifyitems auto-mark hook (by file location — new scenarios need no boilerplate), addopts = -m 'not integration', and tests/integration/* in coverage run.omit.
• A just test-integration recipe (CLI -m integration overrides the default) and a dedicated ubuntu-latest CI job run them; an autouse fixture skips (never fails) when podman is absent.

Verification

just test-ci stays at 100% (357 passed, 3 deselected); just lint-ci and just check-planning clean. The scenarios' behavioral green is produced by the new integration CI job.