fix(ci): RAG ingestion uses git-cloned workspace instead of deploy dir

The runner container doesn't always have /opt/breakpilot-compliance mounted.
Use the git-cloned workspace (current dir) and add multi-fallback for RAG API
URL (container network → localhost → host.docker.internal).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/rag-ingest.yaml

@@ -34,24 +34,24 @@ jobs:
         run: |
           set -euo pipefail
           PHASE="${{ github.event.inputs.phase }}"
-          DEPLOY_DIR="/opt/breakpilot-compliance"
 
           echo "=== RAG Ingestion: Phase ${PHASE} ==="
           echo ""
 
-          # Script aus dem Deploy-Dir nutzen (aktuellster Stand nach git pull)
-          cd "${DEPLOY_DIR}"
+          # Code wurde im Checkout-Step ins aktuelle Verzeichnis geklont
+          # Kein cd noetig — wir sind bereits im Workspace
 
-          # RAG-Service laeuft im Docker-Netzwerk als bp-core-rag-service
-          # Qdrant ist extern erreichbar
           export WORK_DIR="/tmp/rag-ingestion"
-          export RAG_URL="http://bp-core-rag-service:8097/api/v1/documents/upload"
           export QDRANT_URL="https://qdrant-dev.breakpilot.ai"
+
+          # RAG-Service: Versuche Container-Netzwerk, dann Host-Netzwerk
+          export RAG_URL="http://bp-core-rag-service:8097/api/v1/documents/upload"
           export SDK_URL="http://bp-compliance-ai-sdk:8090"
 
-          # Source .env fuer DB_URL falls vorhanden
-          if [ -f .env ]; then
-            export DB_URL=$(grep COMPLIANCE_DATABASE_URL .env 2>/dev/null | cut -d= -f2- || echo "")
+          # Source .env aus Deploy-Dir falls vorhanden (fuer DB_URL)
+          DEPLOY_ENV="/opt/breakpilot-compliance/.env"
+          if [ -f "$DEPLOY_ENV" ]; then
+            export DB_URL=$(grep COMPLIANCE_DATABASE_URL "$DEPLOY_ENV" 2>/dev/null | cut -d= -f2- || echo "")
           fi
 
           mkdir -p "$WORK_DIR"/{pdfs,repos,texts}
@@ -59,17 +59,27 @@ jobs:
           echo "RAG API:  $RAG_URL"
           echo "Qdrant:   $QDRANT_URL"
           echo "Work Dir: $WORK_DIR"
+          echo "PWD:      $(pwd)"
           echo ""
 
           # Health Check: RAG erreichbar?
           # Runner muss im breakpilot-network sein fuer bp-core-rag-service
-          # Fallback: Host-Netzwerk via host.docker.internal
-          if ! curl -sf "$RAG_URL" -X POST 2>/dev/null | head -c 100 | grep -q .; then
+          # Fallback: Host-Netzwerk via localhost (act_runner laeuft auf dem Host)
+          if ! curl -sf "$RAG_URL" -X POST -o /dev/null 2>/dev/null; then
             echo "RAG API nicht im Container-Netzwerk erreichbar."
-            echo "Versuche Host-Netzwerk (host.docker.internal)..."
-            export RAG_URL="http://host.docker.internal:8097/api/v1/documents/upload"
+            echo "Versuche localhost:8097..."
+            export RAG_URL="http://localhost:8097/api/v1/documents/upload"
+            export SDK_URL="http://localhost:8090"
+            if ! curl -sf "$RAG_URL" -X POST -o /dev/null 2>/dev/null; then
+              echo "Versuche host.docker.internal:8097..."
+              export RAG_URL="http://host.docker.internal:8097/api/v1/documents/upload"
+              export SDK_URL="http://host.docker.internal:8090"
+            fi
           fi
 
+          echo "Finale RAG URL: $RAG_URL"
+          echo ""
+
           if [ "$PHASE" = "all" ]; then
             bash scripts/ingest-legal-corpus.sh
           else