feat(drone): enroll drone + gitea SCM dep (M1 implementation)

- tests/gitea/recipe_meta.py: gitea as install-time dep provider; sqlite3
  overlay EXTRA_ENV, health path /api/healthz, relaxed access for CI use
- tests/drone/recipe_meta.py: DEPS=["gitea"]; health /healthz; 600s timeout
- tests/drone/install_steps.sh: wires GITEA_CLIENT_ID + GITEA_DOMAIN +
  client_secret Docker secret + DRONE_USER_CREATE before single drone deploy
- tests/drone/functional/test_scm_configured.py: Playwright-free SCM test —
  follows /login redirect, asserts final URL is gitea dep's OAuth2 authorize
  endpoint with matching client_id (per Adversary pre-probe REVIEW-drone.md)
- tests/drone/PARITY.md: backup structural-skip justified (no backupbot labels)
- runner/harness/sso.py: setup_gitea_oauth() — creates gitea admin user via
  CLI + OAuth2 app via API, returns {admin_user, admin_password, client_id,
  client_secret} for install_steps.sh consumption
- runner/run_recipe_ci.py: _enrich_deps_with_sso now handles gitea dep (calls
  setup_gitea_oauth; keycloak path unchanged)
- tests/unit/test_gitea_dep.py: unit tests for gitea dep path — meta loading,
  SSO routing, SCM redirect assertion logic (parametrized)
- machine-docs: STATUS/JOURNAL/BACKLOG-drone.md phase state files initialized

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

machine-docs/BACKLOG-drone.md

@@ -8,9 +8,33 @@
 
 _(Builder's section — Adversary read-only)_
 
+### M1 tasks
+
+- [x] Read plan + Adversary pre-probes
+- [x] Create phase state files (STATUS/JOURNAL/BACKLOG/REVIEW init)
+- [ ] Implement `setup_gitea_oauth()` in `runner/harness/sso.py`
+- [ ] Extend `_enrich_deps_with_sso` in `runner/run_recipe_ci.py` for gitea
+- [ ] Create `tests/gitea/recipe_meta.py`
+- [ ] Create `tests/drone/recipe_meta.py`
+- [ ] Create `tests/drone/install_steps.sh`
+- [ ] Create `tests/drone/functional/test_scm_configured.py`
+- [ ] Create `tests/drone/PARITY.md`
+- [ ] Write unit tests for new harness surface
+- [ ] Mirror drone + gitea on git.autonomic.zone (for M2 CI path)
+- [ ] Open !testme PR for drone recipe
+- [ ] Claim M1
+
+### M2 tasks (after M1 PASS)
+
+- [ ] CI run via !testme on drone PR — full lifecycle green
+- [ ] Screenshot real + visually verified
+- [ ] Level recorded
+- [ ] DEFERRED updated (build-creation gap narrowed + signed off)
+- [ ] Operator summary written
+- [ ] Claim M2
+
 ---
 
 ## Adversary findings
 
 _(no findings yet — phase in initial state)_
-