feat(2): Q3.5 immich enrollment (recipe_meta + ops + lifecycle overlays + health parity)

immich (object-storage/large-volume photo mgmt; D10 category): 3 services (app incl. ML + web, redis,
database/postgres), self-contained (no SSO dep — local admin; OIDC optional). recipe_meta (HTTP health,
DEPLOY_TIMEOUT=1500), ops.py postgres ci_marker (postgres/immich, backupbot-labelled), lifecycle
overlays, health_check parity. §4.3 upload-asset→list→thumbnail test next (after live-API discovery).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/immich/test_install.py

@@ -0,0 +1,31 @@
+"""immich — INSTALL overlay (Phase 1d, DG4): reuse the generic "really serving" assertion, then add
+recipe-specific checks: the stack serves over HTTPS through the gateway and a real browser loads the
+immich web SPA shell. Login is admin/OIDC-gated (exercised by the functional tests), so the install
+assertion is that the SPA is served. Assertion-only on the shared deployment."""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+from harness import browser as harness_browser, generic, lifecycle  # noqa: E402
+
+
+def test_serving_and_frontend(live_app, meta):
+    generic.assert_serving(live_app, meta)
+    status = lifecycle.http_get(live_app, "/")
+    assert status in (200, 301, 302), f"expected 2xx/3xx from {live_app}, got {status}"
+    from playwright.sync_api import sync_playwright
+
+    url = f"https://{live_app}/"
+    with sync_playwright() as p:
+        browser = p.chromium.launch(args=["--no-sandbox"])
+        try:
+            ctx = browser.new_context(ignore_https_errors=True)
+            page = ctx.new_page()
+            resp = harness_browser.goto_with_retry(
+                page, url, accept_statuses=(200, 301, 302), goto_timeout_ms=60_000
+            )
+            assert resp is not None and resp.status in (200, 301, 302), f"page status {resp and resp.status}"
+            assert "<html" in page.content().lower(), "no HTML served by the immich frontend"
+        finally:
+            browser.close()