fix(drone-dep): correct gitea admin create flag + dep deploy counter

Two issues found during first manual harness run:

1. gitea `--must-change-password false` (space form) leaves a pending
   password-change for the ci_admin user, blocking the OAuth2 API call.
   Fix: use `--must-change-password=false` (equals form, required by
   gitea's BoolFlag with default=true).

2. dep deploy_app() calls incremented the DG4.1 "one deploy per run"
   counter, causing a false violation when gitea dep + drone both deploy.
   Fix: lifecycle.deploy_app gains _count_deploy=True param (default
   backward-compat); deps_mod.deploy_deps passes _count_deploy=False so
   only the recipe-under-test counts toward DG4.1.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

runner/harness/sso.py

@@ -444,8 +444,7 @@ def setup_gitea_oauth(provider_domain: str, parent_domain: str) -> dict:
                 admin_password,
                 "--email",
                 admin_email,
-                "--must-change-password",
-                "false",
+                "--must-change-password=false",  # equals-form required; gitea BoolFlag default=true
             ],
             timeout=120,
         )