M4: harness + green install stage (custom-html + Playwright); guaranteed teardown; M4 CLAIMED

run_recipe_ci.py + conftest + abra/lifecycle wrappers + Nix python/playwright env.
deploy_app forces LETS_ENCRYPT_ENV='' (addresses A1). Short per-run domain scheme
for the 64-char swarm name limit. 2 passed; teardown leaves zero orphans.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

modules/harness.nix

@@ -0,0 +1,20 @@
+# CI harness runtime (M4): a reproducible Python env with pytest + Playwright and the
+# Nix-provided browsers, exposed as `cc-ci-run` on the host so the Drone exec pipeline (and
+# manual dev) can run the harness with `cc-ci-run runner/run_recipe_ci.py`. Playwright on NixOS
+# needs the browsers from nixpkgs (not a downloaded copy) via PLAYWRIGHT_BROWSERS_PATH.
+{ pkgs, ... }:
+let
+  pyEnv = pkgs.python3.withPackages (ps: with ps; [ pytest playwright ]);
+  ccciRun = pkgs.writeShellApplication {
+    name = "cc-ci-run";
+    runtimeInputs = [ pyEnv pkgs.abra pkgs.docker pkgs.git pkgs.coreutils ];
+    text = ''
+      export PLAYWRIGHT_BROWSERS_PATH=${pkgs.playwright-driver.browsers}
+      export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
+      exec ${pyEnv}/bin/python3 "$@"
+    '';
+  };
+in
+{
+  environment.systemPackages = [ ccciRun ];
+}