domain cutover: front doors + drone + per-run naming to ci.autonomic.zone

- acme-dns.nix: ONE dual-zone SAN cert (ci+*.ci.autonomic.zone AND ci+*.ci.commoninternet.net)
  via the same acmedns account — storage re-keyed by cc-ci-acme-storage-seed.service; handoff
  reads the new cert dir. Single secret pair => zero changes to the traefik reconciler.
- dashboard/bridge/reports: dual Host rules during the bake window (bridge gets explicit
  parentheses so && does not shadow the dashboard on the new host).
- drone abra app renamed to drone.ci.autonomic.zone (fresh DB supported: DRONE_USER_CREATE
  re-injects the sops bridge token); runner RPC + bootstrap-drone-oauth.sh follow.
- harness: app_domain() issues *.ci.autonomic.zone run domains; RUN_APP_RE / stack-name
  regexes / docker-prune accept BOTH zones during the bake. Warm stacks deliberately stay
  on the legacy zone (data-warm volumes; post-bake migration).
- URLs in bridge/dashboard defaults + recipe-report.py follow the new names.

runner/harness/warm.py

@@ -25,6 +25,9 @@ import urllib.request
 # Recipes that, when declared as a dep, are served from a shared live-warm instance at a stable
 # domain instead of being co-deployed per run. Maps dep-recipe -> stable domain.
 WARM_DOMAINS = {
+    # Warm stacks stay on the legacy zone through the 2026-09 domain cutover (data-warm
+    # volumes + stack names are tied to the abra app name; renaming re-seeds the CI bases).
+    # They move to *.ci.autonomic.zone in a post-bake phase together with their stacks.
     "keycloak": "warm-keycloak.ci.commoninternet.net",
 }
 
@@ -38,11 +41,12 @@ _CTX.check_hostname = False
 _CTX.verify_mode = ssl.CERT_NONE
 
 # A cold per-run stack name looks like "<tag>-<6hex>_ci_commoninternet_net_<svc>"; extract the hex.
-_STACK_HEX_RE = re.compile(r"^[a-z0-9]{1,4}-([0-9a-f]{6})_ci_commoninternet_net_")
+_STACK_HEX_RE = re.compile(r"^[a-z0-9]{1,4}-([0-9a-f]{6})_ci_(?:autonomic_zone|commoninternet_net)_")
 
 
 def stable_domain(recipe: str) -> str:
     """The stable warm domain for a recipe: `warm-<recipe>.ci.commoninternet.net` — the canonical
+    base's hostname (legacy zone until the post-bake warm-stack migration; see WARM_DOMAINS note).
     scheme for BOTH the live-warm keycloak and the data-warm canonicals (WC2), distinct from cold
     per-run `<recipe[:4]>-<6hex>`. (WARM_DOMAINS['keycloak'] equals stable_domain('keycloak').)"""
     return f"warm-{recipe}.ci.commoninternet.net"