feat(2w): W1 canonical registry module (WC2) + alerts archived

runner/harness/canonical.py: data-warm canonical registry + lifecycle —
is_enrolled (recipe_meta.WARM_CANONICAL), canonical_domain (warm.stable_domain
warm-<recipe>), registry read/write (/var/lib/ci-warm/<recipe>/canonical.json),
has_canonical (record + retained volume), deploy_canonical (reattach volume at
known-good version), undeploy_keep_volume (idle data-warm), seed_canonical
(record + warmsnap snapshot). warm.stable_domain helper added (keycloak path
unchanged). +4 unit tests (61 unit pass).

Also archived the Adversary's verification alert sentinels to alerts/seen/
(simulated rollback + 2 holds — evidentiary, gate PASSED; dir clean for real alerts).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/test_canonical.py

@@ -0,0 +1,61 @@
+"""Unit tests for the WC2 canonical registry (runner/harness/canonical.py).
+
+Pure parts: enrollment (recipe_meta.WARM_CANONICAL), stable domain, registry read/write. The
+data-warm lifecycle (deploy/undeploy-keep-volume/seed) is integration, proven live on a real recipe
+canonical (W1).
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+from harness import canonical, warm  # noqa: E402
+
+
+def test_canonical_domain():
+    assert canonical.canonical_domain("custom-html") == "warm-custom-html.ci.commoninternet.net"
+    assert warm.stable_domain("keycloak") == "warm-keycloak.ci.commoninternet.net"
+    # stable_domain matches the live-warm keycloak's mapping (no divergence)
+    assert warm.stable_domain("keycloak") == warm.WARM_DOMAINS["keycloak"]
+
+
+def test_is_enrolled_missing_meta_false(tmp_path, monkeypatch):
+    # A recipe with no recipe_meta.py is not enrolled.
+    assert canonical.is_enrolled("definitely-not-a-recipe-xyz") is False
+
+
+def test_is_enrolled_reads_flag(tmp_path, monkeypatch):
+    # Point the module's tests/<recipe>/ lookup at a temp recipe by monkeypatching __file__ dir.
+    recipe = "tmpwarm"
+    tests_dir = tmp_path / "tests" / recipe
+    tests_dir.mkdir(parents=True)
+    (tests_dir / "recipe_meta.py").write_text("WARM_CANONICAL = True\n")
+    # canonical.is_enrolled builds the path from canonical.__file__/../../tests/<recipe>; emulate by
+    # creating the layout under a fake harness dir and pointing __file__ there.
+    fake_harness = tmp_path / "runner" / "harness"
+    fake_harness.mkdir(parents=True)
+    monkeypatch.setattr(canonical, "__file__", str(fake_harness / "canonical.py"))
+    assert canonical.is_enrolled(recipe) is True
+    (tests_dir / "recipe_meta.py").write_text("WARM_CANONICAL = False\n")
+    assert canonical.is_enrolled(recipe) is False
+    (tests_dir / "recipe_meta.py").write_text("DEPS = ['keycloak']\n")  # flag absent
+    assert canonical.is_enrolled(recipe) is False
+
+
+def test_registry_roundtrip(tmp_path, monkeypatch):
+    monkeypatch.setenv("CCCI_WARM_ROOT", str(tmp_path))
+    assert canonical.read_registry("custom-html") is None
+    rec = canonical.write_registry("custom-html", version="1.10.0+x", commit="abc123", status="idle")
+    assert rec["domain"] == "warm-custom-html.ci.commoninternet.net"
+    assert rec["version"] == "1.10.0+x" and rec["commit"] == "abc123" and rec["status"] == "idle"
+    back = canonical.read_registry("custom-html")
+    assert back == rec
+    # atomic overwrite to a new status
+    canonical.write_registry("custom-html", version="1.10.0+x", commit="abc123", status="warm")
+    assert canonical.read_registry("custom-html")["status"] == "warm"
+    # the file is valid JSON on disk
+    with open(canonical.registry_path("custom-html")) as f:
+        assert json.load(f)["status"] == "warm"