feat(1e): HC3 additive generic + op/assertion split (orchestrator owns the op)

- orchestrator: per mutating tier, run optional pre-op seed hook (ops.py pre_<op>) → perform the op
  ONCE (harness-owned) → run generic assertion (unless opted out) AND overlay assertion, both against
  the shared post-op deployment. Op results passed op→assertion via run-scoped CCCI_OP_STATE_FILE.
- opt-out: CCCI_SKIP_GENERIC / CCCI_SKIP_GENERIC_<OP> / recipe_meta.SKIP_GENERIC (declarative).
- generic.py: split do_* into op primitives (perform_upgrade/backup/restore) + assertions
  (assert_upgraded/backup_artifact/restore_healthy) reading op_state(); deployed_identity now returns
  {version,image,chaos} (chaos label ready for HC1).
- generic test_<op>.py + all 6 recipe overlays migrated to assertion-only; pre-op seeding moved to
  per-recipe ops.py (pre_upgrade/pre_backup/pre_restore). install overlays unchanged (no op).
- deploy-count stays 1 (op primitives never call deploy_app). lint PASS; 8 unit tests PASS on cc-ci.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/keycloak/test_backup.py

@@ -1,7 +1,9 @@
-"""keycloak — BACKUP overlay (Phase 1d, DG4): seed a known state (the marker realm in mariadb),
-back it up (assert a snapshot artifact), then mutate (delete the realm) so the RESTORE overlay
-(test_restore.py) can prove the backed-up state returns. Runs on the shared deployment; the mutated
-state persists for the restore tier."""
+"""keycloak — BACKUP overlay (Phase 1e HC3): assertion-only + additive.
+
+ops.pre_backup created the marker realm before the backup op captured mariadb; the orchestrator
+performed the backup once (generic tier asserted a snapshot artifact). This overlay ADDS: the marker
+realm is present at backup time. backup-bot-two cycles the container during backup, so wait for
+serving + re-auth first. The backup→restore divergence (deleting the realm) is in ops.pre_restore."""
 
 import os
 import sys
@@ -11,22 +13,7 @@ import kc_admin  # noqa: E402
 from harness import generic  # noqa: E402
 
 
-def test_backup_captures_state(live_app, meta):
-    domain = live_app
-    pw = kc_admin.admin_password(domain)
-    tok = kc_admin.admin_token(domain, pw)
-
-    # 1) create the marker realm, then back up (reuse the generic op: backup + assert a snapshot)
-    assert kc_admin.create_marker_realm(domain, tok) in (201, 409)
-    assert kc_admin.marker_realm_exists(domain, tok)
-    snap = generic.do_backup(domain)
-    assert snap, "backup produced no snapshot artifact"
-
-    # backup-bot-two cycles the keycloak container during backup, so the admin API is briefly 502.
-    # Wait for it to be serving again, then re-auth, before mutating via the HTTP admin API.
-    generic.assert_serving(domain, meta)
-    tok = kc_admin.admin_token(domain, pw)
-
-    # 2) mutate: delete the realm (diverge from the backup)
-    assert kc_admin.delete_marker_realm(domain, tok) in (204, 200)
-    assert not kc_admin.marker_realm_exists(domain, tok), "delete did not take"
+def test_backup_captures_realm(live_app, meta):
+    generic.assert_serving(live_app, meta)  # container cycled during backup; wait for it to be back
+    tok = kc_admin.admin_token(live_app, kc_admin.admin_password(live_app))
+    assert kc_admin.marker_realm_exists(live_app, tok), "marker realm not present at backup time"