ci: add mixed-profile suite to integration matrix on next

The `mixed-profile` integration suite (Full / NonRouting / Leaf
node-role mix introduced by the forklift-upgrade work) is wired
into `testing/ci-local.sh` but was silently absent from the GitHub
Actions integration matrix on next. Regressions to node-role
behavior could land via GitHub CI without the suite running.

Adds a matrix entry plus the matching step block (mirroring the
rekey pattern: generate configs + inject config + compose up +
test + log-collect on failure + compose down always). master
correctly omits the suite from both ci-local and ci.yml since
mixed-profile is forklift-only, so this change never forward-merges
to master.

.github/workflows/ci.yml

@@ -321,6 +321,9 @@ jobs:
             topology: rekey-outbound-only
           - suite: acl-allowlist
             type: acl-allowlist
+          # ── Mixed-profile node-role integration test ─────────────────
+          - suite: mixed-profile
+            type: mixed-profile
           # ── Firewall baseline (fips0 nftables default-deny) ────────────
           - suite: firewall
             type: firewall
@@ -574,6 +577,35 @@ jobs:
           docker compose -f testing/static/docker-compose.yml \
             --profile rekey-outbound-only down --volumes --remove-orphans
 
+      # ── Mixed-profile node-role integration test ───────────────────────────
+      - name: Generate and inject configs (mixed-profile)
+        if: matrix.type == 'mixed-profile'
+        run: |
+          bash testing/static/scripts/generate-configs.sh mixed-profile
+          bash testing/static/scripts/mixed-profile-test.sh inject-config
+
+      - name: Start containers (mixed-profile)
+        if: matrix.type == 'mixed-profile'
+        run: |
+          docker compose -f testing/static/docker-compose.yml \
+            --profile mixed-profile up -d
+
+      - name: Run mixed-profile test
+        if: matrix.type == 'mixed-profile'
+        run: bash testing/static/scripts/mixed-profile-test.sh
+
+      - name: Collect logs on failure (mixed-profile)
+        if: matrix.type == 'mixed-profile' && failure()
+        run: |
+          docker compose -f testing/static/docker-compose.yml \
+            --profile mixed-profile logs --no-color | tail -300
+
+      - name: Stop containers (mixed-profile)
+        if: matrix.type == 'mixed-profile' && always()
+        run: |
+          docker compose -f testing/static/docker-compose.yml \
+            --profile mixed-profile down --volumes --remove-orphans
+
       # ── ACL allowlist integration test ─────────────────────────────────────
       - name: Run ACL allowlist integration test
         if: matrix.type == 'acl-allowlist'