Add sealed CI integration: a GitHub Action and a GitLab CI template

scripts/validate.sh is the engine behind both platforms: download the released standalone jar and the validation configuration (SHA-256-verified when pinned), validate each document, print PASS/FAIL with the failing rule ids and fail on any rejection.
The GitHub Action (action.yml) maps its inputs onto the script's environment; the GitLab template fetches the same script from this repository at KOSIT_SCRIPT_REF and drives it with the same variables, so both platforms run identical logic.
With Docker available the action executes each validation sealed (the "sealed" input, default "auto"): inside an eclipse-temurin:21-jre container without network access, a read-only root and no capabilities, with only the jar, the configuration and a scratch directory mounted; downloads always happen outside the container, so the validator itself never touches the network, and the host JVM setup is skipped entirely for "sealed: always".
The image tag pins the Java 21 JRE contract and floats the patch level: the released jars are the checksummed artifacts, the runtime is a security-patch channel; an "image" input (KOSIT_IMAGE on GitLab) accepts a digest-pinned reference for stricter policies.
The GitLab job image is the same runtime, giving both platforms an identical execution environment, and a devcontainer provides the matching Maven and Java setup for development.
The action self-test validates a conformant XRechnung reference instance and asserts a corrupted one is rejected, exercising the sealed path through the empty-input fallback and an explicit image override, plus the host path.

action.yml

@@ -0,0 +1,101 @@
+name: KoSIT Validator
+description: >-
+  Validate XML documents against a validator configuration (e.g. XRechnung)
+  using the KoSIT validator. Downloads a released validator jar, optionally
+  verifies checksums, runs each file and fails if any document is rejected.
+author: KoSIT contributors
+branding:
+  icon: check-circle
+  color: green
+
+inputs:
+  version:
+    description: >-
+      Validator release to use (a tag of this repository without the leading
+      "v", e.g. "1.6.2"). The standalone jar is downloaded from the GitHub
+      release of this repository.
+    required: false
+    default: "1.6.2"
+  checksum:
+    description: >-
+      Optional SHA-256 checksum of the validator jar. When set, the download
+      is verified against it and the action fails on a mismatch.
+    required: false
+    default: ""
+  configuration:
+    description: >-
+      The validator configuration: either a URL to a configuration zip (for
+      example a release asset of validator-configuration-xrechnung) or a
+      path to an already unpacked configuration directory containing
+      scenarios.xml.
+    required: true
+  configuration-checksum:
+    description: >-
+      Optional SHA-256 checksum of the configuration zip. Only used when
+      "configuration" is a URL.
+    required: false
+    default: ""
+  files:
+    description: >-
+      XML documents to validate: a file, a directory (validated recursively,
+      *.xml) or a shell glob.
+    required: true
+  report-dir:
+    description: Directory the validation reports are written to.
+    required: false
+    default: validator-reports
+  sealed:
+    description: >-
+      Execute the validator inside a Docker container without network access,
+      a read-only root and no capabilities. "auto" (default) seals when
+      Docker is available and falls back to the host JVM otherwise; "always"
+      fails when Docker is unavailable; "never" always uses the host JVM.
+      Downloads are always performed on the host, so the validator itself
+      never needs the network.
+    required: false
+    default: auto
+  image:
+    description: >-
+      Container image for the sealed execution. The default floats on the
+      Java 21 JRE contract so runtime security patches arrive without a
+      change to this repository; pass a digest-pinned reference for a
+      stricter supply-chain policy.
+    required: false
+    default: eclipse-temurin:21-jre
+
+outputs:
+  report-dir:
+    description: Directory containing the validation reports.
+    value: ${{ steps.validate.outputs.report-dir }}
+  accepted:
+    description: Number of accepted documents.
+    value: ${{ steps.validate.outputs.accepted }}
+  rejected:
+    description: Number of rejected documents.
+    value: ${{ steps.validate.outputs.rejected }}
+
+runs:
+  using: composite
+  steps:
+    # The host JVM is only used by unsealed runs: "never", or "auto" on a
+    # runner without Docker. "always" executes exclusively in the container.
+    - name: Set up Java
+      if: ${{ inputs.sealed != 'always' }}
+      uses: actions/setup-java@v5
+      with:
+        distribution: temurin
+        java-version: "21"
+
+    - name: Validate
+      id: validate
+      shell: bash
+      env:
+        KOSIT_VERSION: ${{ inputs.version }}
+        KOSIT_CHECKSUM: ${{ inputs.checksum }}
+        KOSIT_CONFIGURATION: ${{ inputs.configuration }}
+        KOSIT_CONFIGURATION_CHECKSUM: ${{ inputs.configuration-checksum }}
+        KOSIT_FILES: ${{ inputs.files }}
+        KOSIT_REPORT_DIR: ${{ inputs.report-dir }}
+        KOSIT_SEALED: ${{ inputs.sealed }}
+        KOSIT_IMAGE: ${{ inputs.image }}
+      run: bash "$GITHUB_ACTION_PATH/scripts/validate.sh"