review(drone): M2 PASS @2026-06-11T22:30Z — build #506 L5; bridge !testme verified; §7.1 signed

Adversary M2 verdict: PASS. Evidence independently verified:

- results.json build #506: level=5, install+upgrade+custom+lint PASS, backup intentional skip,
  clean_teardown=True, no_secret_leak=True, no unintentional skips
- Drone API: event=custom, status=success, params={PR:1,RECIPE:drone,REF:049438e1cb47},
  sender=autonomic-bot — genuine bridge !testme trigger, not manual
- POLL_REPOS: recipe-maintainers/drone confirmed in bridge.nix
- Screenshot: real drone landing page ("Hello, Welcome to Drone") visually verified
- Gitea dep gite-4c9694 provisioned per-run; SCM test used dep client_id (not production)

DEFERRED build-creation gap §7.1 sign-off: drone OAuth + .drone.yml build-creation API
accepted as a proportionate deferral (harness capability gap, not recipe gap). Maximal
subset (install+upgrade+SCM-configured+lint) proven in build #506. Remaining DEFERRED:
build-creation API automation only.

Phase drone DONE. PR open for operator merge.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

machine-docs/DEFERRED.md

@@ -310,6 +310,8 @@ before the build is called done) — but does **not** force closure.
 
 ### 2026-05-29 — drone (Q4.10) blocked on host /etc/timezone deploy (gitea SCM dep) + scoped integration
 - [x] **RE-ENTERED @2026-06-11:** operator approved — executing as phase `drone` (cc-ci-plan/plan-phase-drone-enroll.md); P0 host /etc/timezone deploy is orchestrator-owned.
+- [x] **MAXIMAL SUBSET COMPLETE @2026-06-11T22:30Z — Adversary M2 PASS, build #506 L5.** All mandatory tiers (install+upgrade+functional+lint) pass; backup structural skip justified in PARITY.md; bridge-triggered !testme CI run confirmed `event:custom`. DEFERRED item progressed: (1) P0 host fix: DONE; (2) Integration MAXIMAL SUBSET: DONE. **Build-creation gap (§4.3) remains open** — deferred sub-item per original filing.
+- **Adversary §7.1 sign-off on build-creation gap @2026-06-11T22:30Z:** The drone API build-creation flow (creating/running CI pipelines via drone's own API — requires drone OAuth token + `.drone.yml` + webhook) is accepted as a genuine, proportionate deferral. It is a harness capability gap, not a recipe gap. Drone boots with gitea SCM wired correctly (proven L5 in build #506); build-creation automation is a follow-on. SIGNED OFF. Remaining DEFERRED: build-creation API automation only.
 - [ ] **What:** drone (Q4.10, LAST §5 recipe) cannot be enrolled until two things land:
       (1) **HOST FIX — operator-deploy needed:** drone is a CI server that REQUIRES a git-provider SCM
       to boot; the only viable dep is **gitea**, which the recipe binds `/etc/timezone:ro` from the