ci: real HA load validation — check_config in pinned container [#778]

Boots HA 2026.8.3 against the repo config with CI-only stub secrets;
catches bad Jinja/unknown keys/schema drift yamllint cannot see.

Meat: https://projects.knownelement.com/issues/778

.gitea/workflows/ci.yml

@@ -26,3 +26,22 @@ jobs:
         run: |
           chmod +x tests/test_sdlc.sh
           bash tests/test_sdlc.sh
+
+  # Real load validation: boots Home Assistant against the repo config and
+  # proves HA can parse + set up every integration (yamllint only proves the
+  # YAML parses; this catches unknown keys, bad Jinja, schema drift).
+  # Pinned to the version the box runs. Stub secrets are CI-only fixtures
+  # (tests/fixtures/secrets-stub.yaml) — never present on the live box.
+  config-check:
+    runs-on: ultix
+    container:
+      image: homeassistant/home-assistant:2026.8.3
+    steps:
+      - uses: actions/checkout@v4
+      - name: homeassistant check_config
+        run: |
+          cp tests/fixtures/secrets-stub.yaml secrets.yaml
+          python3 -m homeassistant --script check_config --config .
+          rc=$?
+          rm -f secrets.yaml home-assistant_v2.db home-assistant.log*
+          exit $rc

tests/fixtures/secrets-stub.yaml

@@ -0,0 +1,7 @@
+# CI-only stub for `homeassistant check_config` (see .gitea/workflows/ci.yml).
+# NEVER copied to the live box. Values are syntactically-valid placeholders.
+deploy_webhook_id: ci-stub-deploy-webhook
+doorman_scan_webhook_id: ci-stub-scan-webhook
+doorman_unlock_url: http://127.0.0.1:1/unlock-stub
+gitea_auth_header: token ci-stub-gitea-token
+kuma_push_url: http://127.0.0.1:1/push?status=up&msg=ci-stub