drone: add recipe-ci pipeline (event=custom) running run_recipe_ci.py

Splits .drone.yml into a push-triggered self-test pipeline and a custom-triggered
recipe-ci pipeline. The bridge fires event=custom builds with RECIPE/REF/PR/SRC
params; recipe-ci runs the shared harness (install/upgrade/backup + recipe-local)
with STAGES set and CCCI_JANITOR_MAX_AGE=0 (safe at capacity=1), concurrency limit 1.
Connects the verified !testme trigger to actual recipe CI (D2/D10 path).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.drone.yml

@@ -1,4 +1,6 @@
 ---
+# Self-test pipeline: runs on normal pushes to cc-ci (M2). Sanity-checks the exec runner can drive
+# host abra/docker. Recipe CI is the separate `custom`-event pipeline below.
 kind: pipeline
 type: exec
 name: self-test
@@ -7,6 +9,10 @@ platform:
   os: linux
   arch: amd64
 
+trigger:
+  event:
+    - push
+
 steps:
   - name: hello
     commands:
@@ -14,3 +20,37 @@ steps:
       - whoami
       - abra --version
       - docker info --format 'swarm={{.Swarm.LocalNodeState}}'
+
+---
+# Recipe-CI pipeline: runs on bridge-triggered builds (event=custom, params RECIPE/REF/PR/SRC set by
+# the comment-bridge). Deploys the recipe at the PR head, runs install/upgrade/backup + any
+# recipe-local tests via the shared harness, then guarantees teardown (plan §4.2/§4.3).
+#
+# Resource safety (plan §4.2/§4.3): MAX_TESTS=DRONE_RUNNER_CAPACITY=1 (modules/drone-runner.nix) is
+# the primary concurrency cap; concurrency.limit below is a redundant belt. CCCI_JANITOR_MAX_AGE=0
+# makes the run-start janitor reap ANY orphaned run app before deploying — safe because capacity=1
+# means no concurrent run exists (a SIGKILL'd/timed-out build leaves an orphan with no teardown).
+kind: pipeline
+type: exec
+name: recipe-ci
+
+platform:
+  os: linux
+  arch: amd64
+
+trigger:
+  event:
+    - custom
+
+concurrency:
+  limit: 1
+
+steps:
+  - name: ci
+    environment:
+      STAGES: install,upgrade,backup
+      CCCI_JANITOR_MAX_AGE: "0"
+    commands:
+      # RECIPE/REF/PR/SRC are injected as env vars from the build's custom params.
+      - 'echo "recipe-ci: RECIPE=$RECIPE REF=$REF PR=$PR SRC=$SRC stages=$STAGES"'
+      - cc-ci-run runner/run_recipe_ci.py