feat(2): Q2.3 — dep resolver + SSO-setup harness primitives

- runner/harness/deps.py: dep resolver primitive (Phase 2 §4.2 / Q2.3).
  - declared_deps(recipe) reads DEPS list from tests/<recipe>/recipe_meta.py
  - dep_domain(parent, pr, ref, dep) — per-run domain per (parent, dep) pair
    so two recipes' deps of the same kind don't collide on a host
  - deploy_deps / teardown_deps — sequential deploy + reverse-order teardown
  - read/write of run-scoped $CCCI_DEPS_FILE
- runner/harness/sso.py: SSO-setup / OIDC-flow primitive (Phase 2 §4.2 / Q2.3).
  - setup_keycloak_realm: idempotent realm + confidential OIDC client +
    test user with generated 25-char alphanumeric password (class-B per §4.4-B);
    returns SsoCreds dict with discovery_url, token_url, all identifiers.
  - oidc_password_grant: exercises the password-grant OIDC flow; returns
    access_token (a JWT) or raises.
  - assert_discovery_endpoint: GET /.well-known/openid-configuration; asserts
    issuer matches the per-run provider domain+realm.
- runner/run_recipe_ci.py: wired in dep deploy BEFORE recipe-under-test, dep
  teardown LAST in finally (reverse order). DG4.1 deploy-count guard now
  expects 1 + len(deps_state) — accommodates declared deps without breaking
  the no-extra-deploys invariant.
- tests/conftest.py: deps_apps fixture reads $CCCI_DEPS_FILE -> dict mapping
  dep_recipe -> dep_domain.
- tests/unit/test_deps.py: 7 unit tests covering declared_deps parsing,
  per-(parent,dep) domain distinctness, run-state JSON write/load, env-var
  no-op semantics. 28/28 unit tests PASS on cc-ci.

Smoke test confirmed deploy_count == expected (1) when no deps declared
(custom-html install run, log /root/ccci-q2-deps-smoke.log).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/conftest.py

@@ -13,7 +13,7 @@ import sys
 import pytest
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "runner"))
-from harness import lifecycle, naming  # noqa: E402
+from harness import deps as deps_mod, lifecycle, naming  # noqa: E402
 
 
 def _short(s: str, n: int = 8) -> str:
@@ -72,6 +72,17 @@ def live_app() -> str:
     return domain
 
 
+@pytest.fixture(scope="session")
+def deps_apps() -> dict[str, str]:
+    """Phase 2 Q2.3 dependency-resolver contract: when a recipe declares `DEPS = [...]` in its
+    `recipe_meta.py`, the orchestrator deploys each dep BEFORE the recipe under test, persists
+    their per-run identity to `$CCCI_DEPS_FILE`, and tears them down LAST in finally. Tests access
+    the dep's per-run domain via this fixture: `deps_apps["keycloak"]` returns the dep's domain
+    or raises KeyError if the dep wasn't declared. Returns {} when the recipe declared no deps."""
+    state = deps_mod.load_run_state()
+    return {entry["recipe"]: entry["domain"] for entry in state if entry.get("domain")}
+
+
 def _wait_healthy(domain, meta):
     lifecycle.wait_healthy(
         domain,