feat(2): Q3.5 immich enrollment (recipe_meta + ops + lifecycle overlays + health parity)

immich (object-storage/large-volume photo mgmt; D10 category): 3 services (app incl. ML + web, redis,
database/postgres), self-contained (no SSO dep — local admin; OIDC optional). recipe_meta (HTTP health,
DEPLOY_TIMEOUT=1500), ops.py postgres ci_marker (postgres/immich, backupbot-labelled), lifecycle
overlays, health_check parity. §4.3 upload-asset→list→thumbnail test next (after live-API discovery).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/immich/ops.py

@@ -0,0 +1,38 @@
+"""immich — pre-op seed hooks (Phase 1e HC3). Marker is a dedicated `ci_marker` row in postgres
+(POSTGRES_USER=postgres, POSTGRES_DB=immich, password /run/secrets/db_password), written via psql in
+the `database` service. The DB is backupbot-labelled (the recipe dumps postgres), so the marker rides
+the backup→restore cycle. (The uploads/model-cache volumes are excluded from backup by the recipe;
+the DB marker is the data-integrity probe.)"""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+from harness import lifecycle  # noqa: E402
+
+
+def _psql(domain, sql):
+    cmd = f'PGPASSWORD=$(cat /run/secrets/db_password) psql -U postgres -d immich -tAc "{sql}"'
+    return lifecycle.exec_in_app(domain, ["sh", "-c", cmd], service="database").strip()
+
+
+def _seed(domain, value):
+    _psql(
+        domain,
+        "CREATE TABLE IF NOT EXISTS ci_marker(v text); DELETE FROM ci_marker; "
+        f"INSERT INTO ci_marker VALUES('{value}');",
+    )
+    assert _psql(domain, "SELECT v FROM ci_marker;") == value
+
+
+def pre_upgrade(domain, meta):
+    _seed(domain, "upgrade-survives")
+
+
+def pre_backup(domain, meta):
+    _seed(domain, "original")
+
+
+def pre_restore(domain, meta):
+    _psql(domain, "DROP TABLE ci_marker;")
+    assert _psql(domain, "SELECT to_regclass('public.ci_marker');") in ("", "NULL"), "drop did not take"