fix(1d): F1d-2 — pinned base deploys the pinned version; upgrade is non-vacuous

- deploy_app: checkout the pinned tag + deploy NON-chaos when a version is pinned (chaos only for
  version=None / PR-head). Was always -C, which ignored the pin and deployed LATEST -> upgrade no-op.
- do_upgrade: assert the deployment actually MOVED (coop-cloud version label and/or image changed)
  via lifecycle.deployed_identity -> a vacuous no-op upgrade can no longer pass (DG2).
- G2: migrate custom-html overlays to the assertion-only contract (override + extend-by-composition
  + data-continuity; split backup/restore). tests/unit/test_discovery.py proves precedence (5/5).

Probe (Adversary's F1d-2 test): hedgedoc deploy-prev=1.10.7 -> upgrade=1.10.8, CHANGED=True.
hedgedoc full generic lifecycle green (install/upgrade/backup/restore, deploy-count=1).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/custom-html/test_backup.py

@@ -1,30 +1,25 @@
-"""custom-html — backup/restore stage (D2): backup, mutate state, restore, assert the restored
-state matches the pre-mutation (backed-up) state."""
+"""custom-html — BACKUP overlay (Phase 1d, DG4): seed a known state, back it up (assert artifact),
+then mutate so the RESTORE overlay (test_restore.py) can prove the backed-up state returns. Runs on
+the shared deployment; the marker it leaves ("mutated") persists for the restore tier."""
 
 import os
 import sys
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
-from harness import lifecycle  # noqa: E402
+from harness import generic, lifecycle  # noqa: E402
 
 MARKER_PATH = "/usr/share/nginx/html/ci-marker.txt"
 
 
-def test_backup_mutate_restore(deployed):
-    domain = deployed
-
-    # 1) establish original state, then back it up
+def test_backup_captures_state(live_app, meta):
+    domain = live_app
+    # 1) establish a known original state, then back it up (reuse the generic op: backup + assert
+    #    a snapshot artifact was produced)
     lifecycle.exec_in_app(domain, ["sh", "-c", f"echo original > {MARKER_PATH}"])
-    assert lifecycle.http_body(domain, "/ci-marker.txt").strip() == "original"
-    lifecycle.backup_app(domain)
+    assert lifecycle.http_fetch(domain, "/ci-marker.txt")[1].strip() == "original"
+    snap = generic.do_backup(domain)
+    assert snap, "backup produced no snapshot artifact"
 
-    # 2) mutate state (diverge from the backup)
+    # 2) mutate state so a successful restore is observable (diverge from the backup)
     lifecycle.exec_in_app(domain, ["sh", "-c", f"echo mutated > {MARKER_PATH}"])
-    assert lifecycle.http_body(domain, "/ci-marker.txt").strip() == "mutated"
-
-    # 3) restore -> state returns to the backed-up "original"
-    lifecycle.restore_app(domain)
-    lifecycle.wait_healthy(domain)
-    assert (
-        lifecycle.http_body(domain, "/ci-marker.txt").strip() == "original"
-    ), "restore did not return the pre-mutation state"
+    assert lifecycle.http_fetch(domain, "/ci-marker.txt")[1].strip() == "mutated"