ci: run native-image integration tests in CI so the shipped binary is what gets tested

[devops-thiago]

Problem Statement

The distributed artifact is a GraalVM native binary, but CI exercises the JVM build only. Native compilation has its own failure class — reflection registration, resources, proxies, build-time initialization — and any of it can break silently in a change that passes every JVM test. The risk grows with the review-pipeline refactor (#669): new AI service interfaces, config mappings, and prompt constants are exactly the kind of change that needs native reflection/resource registration.

Proposed Solution

• Add a CI job that builds the native image (-Pnative) and runs the integration tests against it (quarkus.test.integration-test-profile / @QuarkusIntegrationTest where applicable).
• Run it on PRs touching src/main/**, pom.xml, or src/main/docker/** (path filter keeps the expensive job off docs-only PRs), and always on the release branch/tag.
• Cache the GraalVM/Mandrel toolchain and Maven repo between runs to keep wall-clock acceptable.
• Publish the result in the job summary so a native-only failure is immediately distinguishable from a JVM test failure.

Alternatives Considered

• Native build only at release time (current) — catches breakage at the worst moment, after the offending change merged.
• Nightly native build — cheaper, but decouples the failure from the PR that caused it.

Priority

Important