Retire the acl-allowlist Docker suite; the decision is proven in-process

The ACL admission decision is exhaustively unit-tested per npub over real
loaded allow/deny files (src/node/acl.rs test module: allow-match-wins,
allowlist-miss falls through, deny-only, deny-all, allow_all override,
deny-after-allowlist-miss), and the inbound and outbound handshake-
admission paths are covered in-process over the loopback transport
(src/node/tests/acl.rs: inbound msg1 denial, outbound denial, reload).
The Docker suite's only unique coverage was admission over a real UDP
transport, which every other real-transport suite already exercises, and
its operator-facing log assertion.

Drop it from both runners in lockstep (its *_SUITES array, run function,
default-flow call, --only dispatch arm, and the GitHub matrix leg with
its steps) so the parity guard stays green, and record the retirement in
the deliberately-not-run block with a pointer to the standalone runner.
The testing/acl-allowlist/ suite stays on disk and runs by hand.

.github/workflows/ci.yml

@@ -386,8 +386,6 @@ jobs:
           - suite: admission-cap
             type: admission-cap
             topology: mesh
-          - suite: acl-allowlist
-            type: acl-allowlist
           # ── Firewall baseline (fips0 nftables default-deny) ────────────
           - suite: firewall
             type: firewall
@@ -626,21 +624,6 @@ jobs:
           docker compose -f testing/static/docker-compose.yml \
             --profile rekey-outbound-only down --volumes --remove-orphans
 
-      # ── ACL allowlist integration test ─────────────────────────────────────
-      - name: Run ACL allowlist integration test
-        if: matrix.type == 'acl-allowlist'
-        run: bash testing/acl-allowlist/test.sh --skip-build --keep-up
-
-      - name: Collect logs on failure (acl-allowlist)
-        if: matrix.type == 'acl-allowlist' && failure()
-        run: |
-          docker compose -f testing/acl-allowlist/docker-compose.yml logs --no-color
-
-      - name: Stop containers (acl-allowlist)
-        if: matrix.type == 'acl-allowlist' && always()
-        run: |
-          docker compose -f testing/acl-allowlist/docker-compose.yml down --volumes --remove-orphans
-
       # ── Firewall baseline integration test ─────────────────────────────────
       - name: Run firewall baseline integration test
         if: matrix.type == 'firewall'

testing/ci-local.sh

@@ -28,7 +28,7 @@
 # Integration suites (default coverage):
 #   static-mesh, static-chain, rekey, rekey-accept-off,
 #   rekey-outbound-only, gateway,
-#   acl-allowlist, admission-cap, firewall, nat-cone, nat-symmetric,
+#   admission-cap, firewall, nat-cone, nat-symmetric,
 #   nat-lan, nostr-publish-consume, stun-faults,
 #   chaos-churn-mixed-10, chaos-ethernet-mesh,
 #   chaos-ethernet-only, chaos-tcp-mesh, chaos-congestion-stress,
@@ -54,6 +54,16 @@
 #                    because it asserts nothing. Making it gateable needs a
 #                    calibration corpus that does not exist; see its header.
 #   mesh-lab/        Long-running multi-host lab, not a suite.
+#   acl-allowlist/   Retired from CI 2026-07-24 as redundant, not unrunnable.
+#                    The ACL decision is exhaustively unit-tested per npub over
+#                    real loaded allow/deny files (src/node/acl.rs mod tests:
+#                    allow-wins, allowlist-miss, deny-only, deny-all,
+#                    allow_all-override), and the inbound/outbound handshake-
+#                    admission path is covered in-process over loopback
+#                    (src/node/tests/acl.rs). The Docker suite's only unique
+#                    coverage was real-UDP admission, exercised by every other
+#                    real-transport suite. Still runnable by hand:
+#                    bash testing/acl-allowlist/test.sh
 #   ecn-ab-on, ecn-ab-off, maelstrom, maelstrom-sparse
 #                    Chaos scenarios excluded from CHAOS_SUITES. The two
 #                    ecn-ab ones are halves of the manual comparison above.
@@ -147,7 +157,6 @@ CHAOS_SUITES=(
 #     scenarios' baseline assertions, so no Docker coverage is lost.
 GATEWAY_SUITES=(gateway)
 SIDECAR_SUITES=(sidecar)
-ACL_SUITES=(acl-allowlist)
 FIREWALL_SUITES=(firewall)
 NAT_SUITES=(cone symmetric lan)
 NOSTR_RELAY_SUITES=(nostr-publish-consume)
@@ -189,9 +198,6 @@ list_suites() {
     echo "  Gateway:"
     for s in "${GATEWAY_SUITES[@]}"; do echo "    $s"; done
     echo ""
-    echo "  ACL allowlist:"
-    for s in "${ACL_SUITES[@]}"; do echo "    $s"; done
-    echo ""
     echo "  Firewall baseline:"
     for s in "${FIREWALL_SUITES[@]}"; do echo "    $s"; done
     echo ""
@@ -785,17 +791,6 @@ run_rekey_outbound_only() {
     record "rekey-outbound-only" $rc
 }
 
-# Run ACL allowlist integration test
-run_acl_allowlist() {
-    export COMPOSE_PROJECT_NAME="$(ci_project acl)"
-    info "[acl-allowlist] Running integration test"
-    if bash testing/acl-allowlist/test.sh --skip-build 2>&1; then
-        record "acl-allowlist" 0
-    else
-        record "acl-allowlist" 1
-    fi
-}
-
 # Run firewall baseline integration test
 run_firewall() {
     export COMPOSE_PROJECT_NAME="$(ci_project firewall)"
@@ -938,9 +933,6 @@ run_integration() {
     # Gateway
     run_gateway
 
-    # ACL allowlist
-    run_acl_allowlist
-
     # Firewall baseline
     run_firewall
 
@@ -1055,8 +1047,6 @@ run_suite() {
             run_admission_cap ;;
         gateway)
             run_gateway ;;
-        acl-allowlist)
-            run_acl_allowlist ;;
         firewall)
             run_firewall ;;
         nat-cone|nat-symmetric|nat-lan)