M5: upgrade + backup/restore stages green (custom-html); backup-bot-two oneshot

3-stage run green (install/upgrade/backup), clean teardown. backupbot deployed
via reconcile oneshot; PTY (script) for abra backup/restore; -m for secret generate
(no value leak). M5 CLAIMED.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/conftest.py

@@ -40,6 +40,18 @@ def app_domain(recipe) -> str:
     return f"{tag}-{h}.ci.commoninternet.net"
 
 
+@pytest.fixture
+def deployed(recipe, app_domain, request):
+    """Function-scoped: deploy the current/$REF version healthy, guaranteed teardown after.
+    Used by stages that start from current (install/backup)."""
+    version = os.environ.get("VERSION") or None
+    lifecycle.janitor()
+    request.addfinalizer(lambda: lifecycle.teardown_app(app_domain))
+    lifecycle.deploy_app(recipe, app_domain, version=version)
+    lifecycle.wait_healthy(app_domain)
+    return app_domain
+
+
 @pytest.fixture(scope="session")
 def deployed_app(recipe, app_domain):
     """Install stage: deploy the recipe and wait until healthy; tear down at session end."""