feat(harness): P2 — delete legacy customization keys & paths (rcust)

a) compose.ccci.yml is FIRST-CLASS: the harness auto-copies tests/<recipe>/
   compose.ccci.yml into the run's recipe checkout (ABRA_DIR-aware, lifecycle.
   provide_ccci_overlay) and auto-chaoses the pinned base deploy on its presence
   (kills the R7 implicit coupling). ghost/discourse install_steps.sh (copy-only
   boilerplate) deleted; CHAOS_BASE_DEPLOY removed from both metas + the registry.

b) install-time deps wiring is the ONLY mode: deps with DEPS provision BEFORE the
   single deploy; legacy post-deploy provisioning + the setup_custom_tests.sh
   invocation machinery deleted. lasuite-docs migrated to install_steps.sh OIDC
   wiring (same env names/values as the old hook — only the timing moved);
   lasuite-drive's remaining post-deploy MinIO bucket one-shot moved to ops.py
   pre_install; both setup_custom_tests.sh files deleted; OIDC_AT_INSTALL removed
   from drive/meet metas + the registry.

c) SKIP_GENERIC meta key deleted (zero users). Env form CCCI_SKIP_GENERIC* stays
   as the documented dev-only escape hatch; when active in a drone CI run the
   orchestrator prints a loud !! warning (manifest embedding lands in P5).

d) conftest cleanup: dead pre-deploy-once fixtures deployed/deployed_app deleted
   (zero users), app_domain + _short + _wait_healthy dropped (only users were the
   deleted fixtures); deps_apps+deps_creds consolidated into ONE deps fixture
   (entries expose .domain etc. as attributes; dict access intact); the 6 lasuite
   test files renamed deps_creds->deps (fixture name only — assertions and flows
   byte-identical). requires_deps marker + F2-11 skip-report plumbing unchanged.

Registry is now exactly the 14 final keys; docs §4 table regenerated. Stale
setup_custom_tests/OIDC_AT_INSTALL prose in docstrings/comments/assert MESSAGES
updated (no assert logic or expected value touched).

Verified on cc-ci: cc-ci-run -m pytest tests/unit -q -> 175 passed; scripts/lint.sh -> PASS.

tests/lasuite-drive/functional/test_oidc_with_keycloak.py

@@ -3,12 +3,12 @@
 Drive (La Suite Drive) is OIDC-required: login is gated by an external OpenID Connect provider.
 Mirrors the proven lasuite-docs SSO model:
 - The orchestrator deploys a per-run keycloak dep AFTER the generic tiers and provisions a fresh
-  realm/client/user via `harness.sso.setup_keycloak_realm`; `setup_custom_tests.sh` then wires the
+  realm/client/user via `harness.sso.setup_keycloak_realm`; `install_steps.sh` then wires the
   OIDC env + client secret into the running drive app and redeploys. Creds land in `$CCCI_DEPS_FILE`
-  (read here via the `deps_creds` fixture).
+  (read here via the `deps` fixture).
 - This test consumes those creds and exercises the real OIDC flow against the dep keycloak: discovery
   endpoint advertises the realm, and a password grant yields a valid JWT with the expected claims.
-- Marked `@pytest.mark.requires_deps` so if setup_custom_tests failed the test SKIPs with a clear
+- Marked `@pytest.mark.requires_deps` so if dep provisioning failed the test SKIPs with a clear
   `deps-not-ready` reason — and (per F2-11) the orchestrator then fails the run rather than going
   green on a skipped SSO test.
 
@@ -36,13 +36,13 @@ def _b64url_decode(seg: str) -> bytes:
 
 
 @pytest.mark.requires_deps
-def test_oidc_password_grant_against_dep_keycloak(live_app, deps_creds):
+def test_oidc_password_grant_against_dep_keycloak(live_app, deps):
     """The dep keycloak issues a JWT for the pre-provisioned test user via OIDC password grant."""
-    assert "keycloak" in deps_creds, (
-        f"keycloak creds not in deps_creds; got {list(deps_creds.keys())}. "
-        "setup_custom_tests should have populated this."
+    assert "keycloak" in deps, (
+        f"keycloak creds not in deps; got {list(deps.keys())}. "
+        "dep provisioning should have populated this."
     )
-    kc = deps_creds["keycloak"]
+    kc = deps["keycloak"]
 
     # Creds shape. WC1: realm is per-run namespaced "<parent>-<6hex>"; client_id stays the parent.
     assert kc["domain"]

tests/lasuite-drive/install_steps.sh

@@ -6,7 +6,7 @@
 # BEFORE the single `abra app deploy` (runner/harness/lifecycle.py::_run_install_steps). By writing
 # the OIDC env + the real client secret into the app's `.env` HERE, the recipe deploys ONCE with
 # OIDC already wired — eliminating the flaky post-deploy in-place `--force --chaos` 12-service
-# reconverge that the old setup_custom_tests.sh did (collabora WOPI-discovery race; see JOURNAL
+# post-deploy reconverge (collabora WOPI-discovery race; see JOURNAL
 # Step 0). The orchestrator provisions the per-run realm/client on the live-warm keycloak BEFORE
 # this hook and writes $CCCI_DEPS_FILE (the recipe→creds dict).
 #

tests/lasuite-drive/ops.py

@@ -5,6 +5,7 @@ in the `db` service. The backup path exercises the recipe's pg_backup.sh DB-dump
 backupbot-labelled)."""
 
 import os
+import subprocess
 import sys
 import time
 
@@ -12,6 +13,47 @@ sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner")
 from harness import lifecycle  # noqa: E402
 
 
+def pre_install(domain, meta):
+    """Post-deploy seed for the custom tier (the former setup_custom_tests.sh, moved here in rcust
+    P2b — install_steps.sh runs PRE-deploy and cannot touch the live stack). The deploy alone does
+    NOT create the MinIO bucket: `minio-createbuckets` is a `replicas:0` one-shot (restart_policy:
+    none) that must be triggered. The MinIO storage test asserts the bucket exists, so trigger it
+    here and poll. `--detach` is REQUIRED: the job creates the bucket then EXITS 0, so it never
+    holds a steady 1/1 replica — a blocking scale would wait forever."""
+    stack = domain.replace(".", "_")
+    print("  pre_install: creating MinIO bucket via the minio-createbuckets one-shot", flush=True)
+    subprocess.run(
+        ["docker", "service", "scale", "--detach", f"{stack}_minio-createbuckets=1"],
+        capture_output=True,
+        check=False,
+    )
+    check = (
+        'mc alias set _c http://localhost:9000 "$(cat /run/secrets/minio_ru)" '
+        '"$(cat /run/secrets/minio_rp)" >/dev/null 2>&1 && '
+        "mc ls _c/drive-media-storage >/dev/null 2>&1"
+    )
+    for i in range(30):
+        cid = subprocess.run(
+            ["docker", "ps", "-q", "-f", f"name={stack}_minio.1"],
+            capture_output=True,
+            text=True,
+            check=False,
+        ).stdout.split()
+        if cid and (
+            subprocess.run(
+                ["docker", "exec", cid[0], "sh", "-c", check], capture_output=True, check=False
+            ).returncode
+            == 0
+        ):
+            print(
+                f"  pre_install: bucket drive-media-storage present after {i + 1} poll(s)",
+                flush=True,
+            )
+            return
+        time.sleep(3)
+    raise AssertionError("minio-createbuckets one-shot did not create drive-media-storage in 90s")
+
+
 def _wait_collabora_ready(domain, timeout=420):
     """Gate the upgrade op on collabora being FULLY ready (WOPI discovery endpoint → 200), not just
     container 1/1 'running'. coolwsd takes ~2min to boot (pre-reads 1300+ l10n files + RSA keygen);

tests/lasuite-drive/recipe_meta.py

@@ -18,20 +18,17 @@ DEPLOY_TIMEOUT = 1800
 HTTP_TIMEOUT = 900
 
 # Base deploy/lifecycle proven cold-green @2026-05-28 (install: pass; 12 services incl.
-# onlyoffice+collabora) once the Docker Hub rate limit was fixed. The keycloak SSO dep is now
-# enabled: declaring DEPS triggers the orchestrator's setup_custom_tests step (deploy keycloak +
-# provision realm/client/user + run tests/lasuite-drive/setup_custom_tests.sh to wire OIDC env +
-# in-place redeploy). functional/test_oidc_with_keycloak.py then exercises the SSO flow.
+# onlyoffice+collabora) once the Docker Hub rate limit was fixed. Declaring DEPS makes the
+# orchestrator provision keycloak (realm/client/user) BEFORE the single deploy;
+# functional/test_oidc_with_keycloak.py then exercises the SSO flow.
 DEPS = ["keycloak"]
 
-# Q3.2a (plan-lasuite-drive-oidc-robustness.md Part A): wire OIDC at INSTALL time, not via a
-# post-deploy in-place `--chaos` redeploy. The orchestrator provisions the per-run realm on the
-# live-warm keycloak BEFORE the single `abra app deploy`, and tests/lasuite-drive/install_steps.sh
-# writes the OIDC env + client secret into the .env that one deploy reads. This eliminates the flaky
-# 12-service reconverge (collabora WOPI-discovery race; JOURNAL Step 0). Drive boots fine with OIDC
-# env set because keycloak is live-warm (discovery reachable at boot). setup_custom_tests.sh now
-# only triggers the post-deploy MinIO bucket one-shot.
-OIDC_AT_INSTALL = True
+# OIDC is wired at INSTALL time (the only deps mode since rcust P2b; Q3.2a pioneered it here):
+# the orchestrator provisions the per-run realm on the live-warm keycloak BEFORE the single
+# `abra app deploy`, and tests/lasuite-drive/install_steps.sh writes the OIDC env + client secret
+# into the .env that one deploy reads. No post-deploy reconverge (the flaky 12-service collabora
+# WOPI race is structurally gone). The post-deploy MinIO bucket one-shot lives in ops.py
+# pre_install (the former setup_custom_tests.sh, deleted in P2b).
 
 
 def READY_PROBE(domain):

tests/lasuite-drive/setup_custom_tests.sh

@@ -1,39 +0,0 @@
-#!/usr/bin/env bash
-# lasuite-drive — POST-DEPLOY setup hook (Phase 2 Q3.2a).
-#
-# As of Q3.2a (plan-lasuite-drive-oidc-robustness.md Part A) OIDC is wired at INSTALL time by
-# tests/lasuite-drive/install_steps.sh (before the single `abra app deploy`), so this hook NO LONGER
-# does any OIDC env wiring or in-place redeploy — that eliminated the flaky 12-service reconverge
-# (collabora WOPI race; see JOURNAL Step 0). What remains here is the ONE post-deploy step that
-# genuinely needs the live stack: triggering the MinIO bucket-creation one-shot. The orchestrator
-# runs this only on the install-time path AFTER the deploy is healthy (deps already provisioned).
-#
-# Env supplied by the orchestrator:
-#   CCCI_APP_DOMAIN  — the running per-run lasuite-drive app domain
-#   CCCI_DEPS_FILE   — JSON deps creds dict (unused here now; OIDC handled at install)
-set -euo pipefail
-
-: "${CCCI_APP_DOMAIN:?missing}"
-
-# The deploy alone does NOT create the MinIO bucket — `minio-createbuckets` is a `replicas:0`
-# one-shot (restart_policy: none) that must be triggered. The MinIO storage test asserts the bucket
-# exists, so create it here. `--detach` is REQUIRED: the job creates the bucket then EXITS 0, so it
-# never holds a steady 1/1 replica; a blocking `docker service scale ...=1` would wait forever and
-# hang the run. With `--detach` the scale just submits the one-run and returns; the poll loop below
-# confirms the bucket was actually created.
-STACK=$(printf '%s' "$CCCI_APP_DOMAIN" | tr '.' '_')
-echo "  setup: creating MinIO bucket via the minio-createbuckets one-shot (scale 0->1)"
-docker service scale --detach "${STACK}_minio-createbuckets=1" >/dev/null 2>&1 || true
-# Wait up to 90s for the one-shot to create the bucket (mc mb drive/drive-media-storage; exit 0).
-# Poll by checking the bucket directly from the running minio replica container.
-for i in $(seq 1 30); do
-  MC_CID=$(docker ps -q -f "name=${STACK}_minio.1" | head -1)
-  if [ -n "$MC_CID" ] && docker exec "$MC_CID" sh -c \
-    'mc alias set _c http://localhost:9000 "$(cat /run/secrets/minio_ru)" "$(cat /run/secrets/minio_rp)" >/dev/null 2>&1 && mc ls _c/drive-media-storage >/dev/null 2>&1'; then
-    echo "  setup: bucket drive-media-storage present after ${i} poll(s)"
-    break
-  fi
-  sleep 3
-done
-
-echo "  lasuite-drive setup_custom_tests: post-deploy MinIO bucket step complete (OIDC wired at install)"