feat: runtime manager

integration/README.md

@@ -39,6 +39,9 @@ integration/
 ├── lobbynotification/
 │   ├── lobby_notification_test.go
 │   └── race_name_intents_test.go
+├── lobbyrtm/
+│   ├── harness_test.go
+│   └── lobby_rtm_test.go
 ├── go.mod
 ├── go.sum
 └── internal/
@@ -49,10 +52,13 @@ integration/
     │       └── contract.go
     └── harness/
         ├── binary.go
+        ├── dockernetwork.go
+        ├── engineimage.go
         ├── keys.go
         ├── mail_stub.go
         ├── process.go
         ├── redis_container.go
+        ├── rtmanagerservice.go
         ├── smtp_capture.go
         └── user_stub.go
 ```
@@ -95,15 +101,23 @@ integration/
   applications, invites, member operations, runtime pause, cascade
   membership block, and the three race-name intents emitted by capability
   evaluation at game finish and by self-service registration.
+- `lobbyrtm` verifies the asynchronous boundary between real
+  `Game Lobby` and real `Runtime Manager` end-to-end against a real
+  Docker daemon: start_job → engine container → success job_result →
+  game `running`; cascade-blocked owner → stop_job(cancelled) → engine
+  stopped; missing image → failure job_result + admin notification
+  intent → game `start_failed`. Skips automatically on hosts without
+  Docker.
 
 The current fast suites still use one isolated `miniredis` instance plus either
 real downstream processes or external stateful HTTP stubs where appropriate.
 `authsessionmail`, `gatewayauthsessionmail`, `notificationgateway`,
 `notificationmail`, `notificationuser`, `gatewayauthsessionusermail`,
-`lobbyuser`, and `lobbynotification` are the deliberate exceptions: they use
-one real Redis container through `testcontainers-go`, because those
-boundaries must exercise real Redis stream, persistence, or scheduling
-behavior.
+`lobbyuser`, `lobbynotification`, and `lobbyrtm` are the deliberate
+exceptions: they use one real Redis container through
+`testcontainers-go`, because those boundaries must exercise real Redis
+stream, persistence, or scheduling behavior. `lobbyrtm` additionally
+needs a real Docker daemon and the `galaxy/game` engine image.
 `authsessionmail` additionally contains one targeted SMTP-capture scenario for
 the real `smtp` provider path, while `gatewayauthsessionmail` keeps `Mail
 Service` in `stub` mode and extracts the confirmation code through the trusted
@@ -127,6 +141,7 @@ go test ./notificationuser/...
 go test ./gatewayauthsessionusermail/...
 go test ./lobbyuser/...
 go test ./lobbynotification/...
+go test ./lobbyrtm/...
 ```
 
 Useful regression commands after boundary changes:
@@ -144,6 +159,7 @@ go test ./notificationuser/...
 go test ./gatewayauthsessionusermail/...
 go test ./lobbyuser/...
 go test ./lobbynotification/...
+go test ./lobbyrtm/...
 cd ../gateway && go test ./...
 cd ../authsession && go test ./... -run GatewayCompatibility
 cd ../user && go test ./...