ci: skip kafka module tests; switch multi-server broker to dev-container mode

CI rounds 1-2 showed two different redpanda startup failures:

 - In the ci.yml / ci-sanitizers.yml `services:` stanzas, seastar
   exits EINVAL on the self-hosted runners because GitHub Actions
   services give us no way to override the default command line.
   There's no good workaround via `options:` so drop the redpanda
   service container, remove the kafka_test_server passthrough, and
   let the kafka module tests skip cleanly (the existing
   kafka_require_test_server gate already handles the empty-server
   case).  The multi-server kafka-produce test still exercises the
   full produce path end-to-end.

 - The multi-server docker-compose had a hand-rolled list of redpanda
   start flags (`--overprovisioned --smp=1 ... --unsafe-bypass-fsync`)
   which still failed to boot on the shared runner.  Replace it with
   Redpanda's official single-node preset `--mode dev-container`,
   which sets the right seastar probing and IO defaults for a
   containerised CI environment, and keep only the overrides we
   actually need on top (smp/memory/node-id and the advertised
   listener address).

Author: arr2036

.github/actions/ci-tests/action.yml

@@ -57,9 +57,17 @@ inputs:
     description: SMTP server SMTP port
     default: 2525
 
+  #
+  #  Kafka is opt-in.  Redpanda (our Kafka-compatible test broker) can't
+  #  start with the default command on GitHub Actions `services:` runners
+  #  - the seastar runtime fails EINVAL without extra flags we can't pass
+  #  through the services stanza.  Leaving this empty makes
+  #  test.modules.kafka skip cleanly; the multi-server kafka test covers
+  #  the full produce path via docker-compose.
+  #
   kafka_test_server:
-    description: Kafka/Redpanda broker host
-    default: 127.0.0.1
+    description: Kafka/Redpanda broker host (empty = skip kafka module tests)
+    default: ""
   kafka_test_server_port:
     description: Kafka/Redpanda broker port
     default: 9092

.github/workflows/ci-sanitizers.yml

@@ -129,18 +129,11 @@ jobs:
           --health-retries 5
 
       #
-      #  Pulled from docker.redpanda.com rather than the FreeRADIUS internal
-      #  docker cache because redpandadata/redpanda is not mirrored there.
+      #  No redpanda service container: seastar exits EINVAL on these
+      #  runners with the default command, and GitHub Actions services
+      #  don't let us override it.  Kafka module tests skip here; the
+      #  multi-server kafka-produce test covers the produce path instead.
       #
-      redpanda:
-        image: docker.redpanda.com/redpandadata/redpanda:latest
-        ports:
-          - 9092:9092
-        options: >-
-          --health-cmd "rpk cluster health --exit-when-healthy"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 10
 
     steps:
 
@@ -199,8 +192,6 @@ jobs:
           imap_test_server_ssl_port: 1432
           smtp_test_server: 127.0.0.1
           smtp_test_server_port: 2525
-          kafka_test_server: redpanda
-          kafka_test_server_port: 9092
 
       #
       #  If the CI has failed and the branch is ci-debug then we start a tmate

.github/workflows/ci.yml

@@ -135,23 +135,13 @@ jobs:
           --health-retries 5
 
       #
-      #  Redpanda - a Kafka-compatible broker.  rlm_kafka tests talk to this
-      #  on port 9092.  No setup script is needed: librdkafka auto-creates the
-      #  test topics on first produce.
+      #  No redpanda service container here - seastar exits EINVAL on the
+      #  self-hosted runners when started with the default command, and
+      #  GitHub Actions `services:` gives us no way to override the
+      #  command line.  The kafka module tests are skipped in this
+      #  workflow; the multi-server kafka-produce test brings its own
+      #  broker up via docker-compose with the right flags.
       #
-      #  Pulled from docker.redpanda.com rather than the FreeRADIUS internal
-      #  docker cache because redpandadata/redpanda is not mirrored there.
-      #  Matches the image used by the multi-server test harness.
-      #
-      redpanda:
-        image: docker.redpanda.com/redpandadata/redpanda:latest
-        ports:
-          - 9092:9092
-        options: >-
-          --health-cmd "rpk cluster health --exit-when-healthy"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 10
 
     steps:
 
@@ -211,8 +201,6 @@ jobs:
           imap_test_server_ssl_port: 1432
           smtp_test_server: 127.0.0.1
           smtp_test_server_port: 2525
-          kafka_test_server: redpanda
-          kafka_test_server_port: 9092
 
       - name: Run fuzzer
         uses: ./.github/actions/fuzzer

src/tests/multi-server/environments/kafka.yml.j2

@@ -35,20 +35,24 @@ services:
     # compose service name.  Without this the broker tells clients to
     # reconnect at 127.0.0.1:9092 which only works when client and
     # broker share a network namespace.
+    #
+    #  `--mode dev-container` is Redpanda's blessed single-node dev
+    #  preset: it relaxes IO/memory probing so the broker boots on a
+    #  shared CI runner without needing root, hugepages, or a tuned
+    #  seastar profile.  Everything else is the minimum we need on top.
+    #
     command:
     - redpanda
     - start
+    - --mode
+    - dev-container
     - --kafka-addr
     - PLAINTEXT://0.0.0.0:9092
     - --advertise-kafka-addr
     - PLAINTEXT://kafka:9092
-    - --overprovisioned
     - --smp=1
     - --memory=1G
-    - --reserve-memory=0M
     - --node-id=0
-    - --check=false
-    - --unsafe-bypass-fsync=true
     restart: unless-stopped
     #
     #  Redpanda needs longer than you'd think on a busy CI runner: the