M6 (part 1): per-recipe meta + D4 recipe-local discovery + shared naming helper

Recipe-agnostic harness (no surgery to enroll a recipe): recipe_meta.py for
health path/codes/timeouts; run_recipe_local discovers + runs recipe-shipped
tests/ against the live app. install non-regressed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

runner/harness/naming.py

@@ -0,0 +1,20 @@
+"""Shared run-app domain naming (used by the conftest fixtures and the orchestrator).
+
+Domain = "<recipe[:4]>-<6hex(recipe|pr|ref)>.ci.commoninternet.net" — short enough for Docker's
+64-char swarm config/secret name limit, unique per run, collision-safe across recipes (DECISIONS.md).
+"""
+from __future__ import annotations
+
+import hashlib
+import time
+
+
+def _short(s: str, n: int = 8) -> str:
+    return "".join(c for c in s if c.isalnum())[:n] or "local"
+
+
+def app_domain(recipe: str, pr: str = "0", ref: str | None = None) -> str:
+    ref = ref or ("local" + str(int(time.time())))
+    tag = _short(recipe, 4).lower()
+    h = hashlib.sha1(f"{recipe}|{pr}|{ref}".encode()).hexdigest()[:6]
+    return f"{tag}-{h}.ci.commoninternet.net"