feat(drone): enroll drone + gitea SCM dep (M1 implementation)

- tests/gitea/recipe_meta.py: gitea as install-time dep provider; sqlite3
  overlay EXTRA_ENV, health path /api/healthz, relaxed access for CI use
- tests/drone/recipe_meta.py: DEPS=["gitea"]; health /healthz; 600s timeout
- tests/drone/install_steps.sh: wires GITEA_CLIENT_ID + GITEA_DOMAIN +
  client_secret Docker secret + DRONE_USER_CREATE before single drone deploy
- tests/drone/functional/test_scm_configured.py: Playwright-free SCM test —
  follows /login redirect, asserts final URL is gitea dep's OAuth2 authorize
  endpoint with matching client_id (per Adversary pre-probe REVIEW-drone.md)
- tests/drone/PARITY.md: backup structural-skip justified (no backupbot labels)
- runner/harness/sso.py: setup_gitea_oauth() — creates gitea admin user via
  CLI + OAuth2 app via API, returns {admin_user, admin_password, client_id,
  client_secret} for install_steps.sh consumption
- runner/run_recipe_ci.py: _enrich_deps_with_sso now handles gitea dep (calls
  setup_gitea_oauth; keycloak path unchanged)
- tests/unit/test_gitea_dep.py: unit tests for gitea dep path — meta loading,
  SSO routing, SCM redirect assertion logic (parametrized)
- machine-docs: STATUS/JOURNAL/BACKLOG-drone.md phase state files initialized

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

runner/run_recipe_ci.py

@@ -474,8 +474,9 @@ def _enrich_deps_with_sso(parent_recipe: str, parent_domain: str, deps_list) ->
     setup function, then return a recipe→entry dict carrying domain + admin + realm/client/user
     info — the shape the `install_steps.sh` hook (and dependent tests) read.
 
-    Provider routing: today only `keycloak` is supported. authentik will need a parallel
-    `setup_authentik_realm` when an authentik-dep recipe enrolls (DEFERRED.md #9).
+    Provider routing: keycloak (OIDC realm/client) and gitea (OAuth2 app for drone) are
+    supported. authentik will need a parallel `setup_authentik_realm` when an authentik-dep
+    recipe enrolls (DEFERRED.md #9).
     """
     from harness import sso, warm  # local import — sso may not be needed for dep-less runs
 
@@ -485,6 +486,19 @@ def _enrich_deps_with_sso(parent_recipe: str, parent_domain: str, deps_list) ->
         dep_domain = entry.get("domain")
         if not dep_recipe or not dep_domain:
             continue
+        if dep_recipe == "gitea":
+            # Gitea dep provider (phase drone): create admin user + OAuth2 app so the
+            # dependent recipe's install_steps.sh can wire DRONE_GITEA_* before deploy.
+            creds = sso.setup_gitea_oauth(dep_domain, parent_domain)
+            out[dep_recipe] = {
+                "recipe": dep_recipe,
+                "domain": dep_domain,
+                "admin_user": creds["admin_user"],
+                "admin_password": creds["admin_password"],
+                "client_id": creds["client_id"],
+                "client_secret": creds["client_secret"],
+            }
+            continue
         if dep_recipe != "keycloak":
             # Provider not yet supported — record bare entry; install_steps.sh / tests will
             # raise if they need realm/client info they don't see.