harden Docker image, add monthly rebuilds, run xt tests in CI (NicTool#342)

Migrate 18_interaction.t and 20_permission.t from Test.pm to
Test::More so prove can parse the TAP output. Run all four xt
test files (5,996 tests) inside the CI container on every PR.

Add apt-get upgrade to the Dockerfile so images pick up security
patches. Add a monthly cron rebuild (1st of month, 6 AM UTC) to
keep production images current between code changes.

Co-authored-by: Moses Ingersoll <258583966+burning-bush-dev@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: burning-bush-dev

.github/workflows/ci.yml

@@ -125,6 +125,9 @@ jobs:
       - name: Run server tests
         run: docker exec ci make -C /workspace/server test
 
+      - name: Run extended permission & delegation tests
+        run: docker exec -w /workspace/server ci bash -c 'prove -v xt/*.t'
+
       - name: Failure diagnostics
         if: failure()
         run: |

.github/workflows/docker.yml

@@ -1,6 +1,8 @@
 name: Docker
 
 on:
+  schedule:
+    - cron: '0 6 1 * *'  # 6 AM UTC on the 1st of each month
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
@@ -64,6 +66,9 @@ jobs:
       - name: Run client tests
         run: docker compose -f dist/docker/docker-compose.yml exec -T web make -C /usr/local/nictool/client test
 
+      - name: Run extended permission & delegation tests
+        run: docker compose -f dist/docker/docker-compose.yml exec -T web bash -c 'cd /usr/local/nictool/server && prove -v xt/*.t'
+
       - name: Failure diagnostics
         if: failure()
         run: |

dist/docker/Dockerfile

@@ -4,7 +4,7 @@ FROM debian:bookworm AS base
 
 ENV DEBIAN_FRONTEND=noninteractive LANG=en_US.UTF-8 LC_ALL=C.UTF-8
 
-RUN apt-get -q update && apt-get install -qy \
+RUN apt-get -q update && apt-get upgrade -qy && apt-get install -qy \
       perl \
       cpanminus \
       build-essential \