v1.1 — Hosted CI + Ubuntu substrate

Stage 2 — Step 18 lands. Additive change: every Stage 1 substrate
invariant (unprivileged-LXC only, helm-first delivery, mandatory
CAPI pivot, dual-stack networking, CAPI/CAPN version pins) is
preserved. Production target stays Debian 13; Ubuntu is added only
for the CI substrate.

Authoritative spec: plans/PLAN-stage2-1.md §23.

Added

• Hosted CI on GitHub Actions — tests/molecule/gha Molecule
  scenario plus .github/workflows/molecule.yml. Runs the full
  canonical bootstrap → pivot → workload flow on ubuntu-latest
  via ansible_connection: local (no nested virtualisation).
  converge.yml and verify.yml import_playbook the e2e-local
  equivalents verbatim — single source of truth for the flow.
• make -C tests/molecule gha-local-* target family — CI-only,
  three-layer guard refuses local invocation (Makefile + playbook
  assert + workflow-only).
• requirements-gha.txt — fully pinned Python dependency lockfile
  for the CI workflow (primaries + transitives resolved on Python
  3.13).
• Role variable bootstrap_clusterctl_cert_manager_timeout (default
  "" = inherit clusterctl's 10-min internal wait; rendered into
  clusterctl.yaml when non-empty).
• plans/PLAN-stage2-1.md — §23 / Step 18 spec, status: completed.
• AGENTS.md — router document for coding agents.

Changed

• All 14 role preflights: OS gate widened from Debian 13+ to
  Debian 13+ OR Ubuntu 22.04+. Purely additive.
• doc/12-testing.md §11 rewritten (was "There is no CI"); §2
  scenario table grew a 15th row for gha; new §5.3 documents the
  gha-local-* Makefile family.
• "Debian-family Linux" → "Debian or Ubuntu Linux" prose update
  across README.md, AGENTS.md, CITATION.cff, mkdocs.yml,
  llms.txt, all doc/*.md, and tests/molecule/shared/verify.yml.
  README badge updated.
• plans/PLAN-stage2-common.md — Hosted CI path without local
  runner item moved to PLAN-stage2-1.md (completed).
• Workflow installs Helm v4.1.4 and kubectl v1.35.3 via
  azure/setup-{helm,kubectl}@v4.

Fixed

• ansible/roles/lxd_host/tasks/bridge.yml — MulticastSnooping=no
  on br-ext6. Without it the kernel snoops with no querier on the
  pure-L2 segment and stops flooding upstream Router Advertisements
  to container ports after the MLD membership timeout, breaking
  SLAAC on freshly joined CAPN nodes. Matching assertion added to
  tests/molecule/lxd-host/verify.yml.

Acceptance

• GHA workflow run 25793173461
  — green on tests/molecule/gha (e2e on runner).
• Local Vagrant clean-VM make test-local-e2e (2026-05-13) — three
  PLAY RECAPs, all failed=0 unreachable=0.

Full diff
— 56 files, +2181 / -238.