feat(2): Q4.8 — uptime-kuma Phase-2 enrollment + 3 tests cold green

Recipe-maintainer corpus has no uptime-kuma tests/ directory (uptime-kuma wasn't in their parity
suite), so PARITY.md documents Phase-2 health_check as the parity-aligned baseline + 2 specific
tests beyond.

- tests/uptime-kuma/recipe_meta.py: HEALTH_PATH=/ accepts 200 or 302 (setup-wizard redirect).
- tests/uptime-kuma/functional/test_health_check.py: GET / returns 200/302.
- tests/uptime-kuma/functional/test_socketio_handshake.py: GET /socket.io/?EIO=4&transport=polling
  returns Engine.IO open packet (body starts with 0{, JSON has sid+pingInterval). Proves the
  real-time backend is wired through the nginx proxy.
- tests/uptime-kuma/functional/test_spa_branding.py: GETs /; asserts 'kuma' brand + SPA-bundle
  asset references (/assets/, /icon.svg, /favicon, main.) in the rendered HTML.
- Plan §4.3 prescribed 'create-a-monitor + list-it' deferred (Q4 follow-up — needs Socket.IO
  client + setup-wizard flow; substantial harness addition). PARITY.md documents the deferral.

Cold-verifiable: ssh cc-ci 'RECIPE=uptime-kuma STAGES=install,custom cc-ci-run runner/run_recipe_ci.py'
  install + 3 custom tests PASS, deploy-count=1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/uptime-kuma/functional/test_socketio_handshake.py

@@ -0,0 +1,70 @@
+"""uptime-kuma — recipe-specific functional test (Phase 2 P3).
+
+uptime-kuma's defining feature is **real-time monitoring** delivered over Socket.IO. The
+recipe routes /socket.io/* to the app. A working uptime-kuma must complete the Engine.IO v4
+polling handshake at `/socket.io/?EIO=4&transport=polling`:
+- HTTP 200
+- Body starts with `0{` — the Engine.IO `open` packet (type 0) + JSON metadata (sid, upgrades,
+  pingInterval, pingTimeout)
+
+Non-vacuous: a working HTTP front-end with a wedged Socket.IO backend returns 404 or 502 here.
+A misrouted nginx returns 404. Only a correctly-wired uptime-kuma + Engine.IO listener responds
+with the Engine.IO open packet.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import ssl
+import sys
+import urllib.request
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", "runner"))
+from harness import http as harness_http  # noqa: E402
+
+
+def test_socketio_polling_handshake(live_app):
+    """GET /socket.io/?EIO=4&transport=polling → 200, body starts with '0{' + valid JSON."""
+    url = f"https://{live_app}/socket.io/?EIO=4&transport=polling"
+
+    ctx = ssl.create_default_context()
+    ctx.check_hostname = False
+    ctx.verify_mode = ssl.CERT_NONE
+
+    def _fetch():
+        req = urllib.request.Request(url, method="GET")
+        try:
+            with urllib.request.urlopen(req, timeout=15, context=ctx) as r:
+                if r.status != 200:
+                    return None
+                body = r.read().decode(errors="replace")
+        except Exception:  # noqa: BLE001
+            return None
+        if not body.startswith("0"):
+            return None
+        # Body shape: `<length>:<packet>` or just the packet on EIO v4. We accept either.
+        # Locate the leading `0{` (Engine.IO open packet)
+        idx = body.find("0{")
+        if idx < 0:
+            return None
+        json_str = body[idx + 1 :]  # skip the leading "0"
+        # The JSON may be followed by other Engine.IO frames; take everything to the last '}'
+        end = json_str.rfind("}")
+        if end < 0:
+            return None
+        try:
+            parsed = json.loads(json_str[: end + 1])
+        except (json.JSONDecodeError, ValueError):
+            return None
+        # Engine.IO v4 'open' packet carries sid, upgrades, pingInterval, pingTimeout
+        if not isinstance(parsed, dict) or "sid" not in parsed:
+            return None
+        return parsed
+
+    info = harness_http.assert_converges(
+        _fetch, f"GET {url} returns Engine.IO open packet", max_wait=60, interval=3
+    )
+    # Standard Engine.IO open-packet fields
+    assert "sid" in info, f"no sid in handshake: {info!r}"
+    assert "pingInterval" in info, f"no pingInterval in handshake: {info!r}"