feat(harness): P5 — customization manifest (rcust)

One block at run start answering "what does this recipe customize?" across every surface
(non-default recipe_meta keys, ops.py pre-ops, install_steps.sh, compose.ccci.yml, lifecycle
overlays by source, custom-test counts, active CCCI_SKIP_GENERIC* env overrides — !!-flagged when
riding a CI run, P2c), printed to the run log and embedded verbatim in results.json under
"customization". Pure presentation — building/printing it never influences a verdict; the
manifest honors the HC2 repo-local gate so it never advertises code the run will not execute.

Unit tests: synthetic recipe exercising every surface -> complete + deterministic + JSON-clean;
HC2 invisibility; env-override flagging; render golden lines; build_results threads the dict
verbatim (key always present, None when absent).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/unit/test_results.py

@@ -280,6 +280,41 @@ def test_build_results_threads_expected_na(tmp_path):
     )  # backup_restore declared; functional passed → clean
 
 
+def test_build_results_threads_customization(tmp_path):
+    # rcust P5: the run-start customization manifest lands verbatim under "customization";
+    # omitted -> explicit None (key always present in the schema).
+    recs = [
+        {
+            "tier": "install",
+            "source": "generic",
+            "file": "g/test_install.py",
+            "rc": 0,
+            "junit": _write(tmp_path, "i.xml", JUNIT_PASS),
+        },
+    ]
+    cust = {
+        "meta_non_default": {"HTTP_TIMEOUT": 600},
+        "hooks": {"install_steps.sh": "cc-ci"},
+        "overlays": {},
+        "custom_tests": {"cc-ci": {"functional": 2}},
+        "env_overrides": [],
+    }
+    kwargs = {
+        "recipe": "hedgedoc",
+        "version": "1.2.3",
+        "pr": "7",
+        "ref": None,
+        "records": recs,
+        "results": _results(),
+        "backup_capable": True,
+        "clean_teardown": True,
+        "no_secret_leak": True,
+        "finished_ts": 0.0,
+    }
+    assert R.build_results(**kwargs, customization=cust)["customization"] == cust
+    assert R.build_results(**kwargs)["customization"] is None
+
+
 def test_write_results_roundtrip(tmp_path):
     data = {"run_id": "42", "level": 3, "stages": []}
     path = R.write_results(data, runs_dir_override=str(tmp_path))