feat(2): Q4.6 discourse — recipe_meta + postgres P4 overlays + health (WIP, §4.3 create-topic next)

discourse (forum: postgres+redis+sidekiq). HEALTH_PATH=/srv/status (slow Rails boot, DEPLOY_TIMEOUT=1800).
P4 via postgres ci_marker (db service, pg_dump backupbot — matrix-synapse pattern). Health functional
test. §4.3 create-a-topic + PARITY.md to follow after smoke discovers the admin/API bootstrap path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/discourse/ops.py

@@ -0,0 +1,47 @@
+"""discourse — pre-op seed hooks (Phase 1e HC3 / Phase 2 P4 backup data-integrity).
+
+Discourse persists in postgres (`db` service, user/db=discourse). The recipe's backupbot pre-hook
+pg_dumps that DB, and restore reloads the dump — so real backup data-integrity = seed a `ci_marker`
+row into the discourse DB, back up, mutate, restore, and prove the row survived (the same DB the
+recipe actually backs up). Mirrors the matrix-synapse postgres pattern.
+"""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+from harness import lifecycle  # noqa: E402
+
+
+def _psql(domain, sql):
+    cmd = (
+        'PGPASSWORD=$(cat /run/secrets/db_password) '
+        f'psql -U discourse -d discourse -tAc "{sql}"'
+    )
+    return lifecycle.exec_in_app(domain, ["sh", "-c", cmd], service="db").strip()
+
+
+def _seed(domain, value):
+    _psql(
+        domain,
+        "CREATE TABLE IF NOT EXISTS ci_marker(v text); DELETE FROM ci_marker; "
+        f"INSERT INTO ci_marker VALUES('{value}');",
+    )
+    got = _psql(domain, "SELECT v FROM ci_marker;")
+    assert got == value, f"seed did not commit (read back {got!r}, expected {value!r})"
+
+
+def pre_upgrade(domain, meta):
+    _seed(domain, "upgrade-survives")
+
+
+def pre_backup(domain, meta):
+    _seed(domain, "original")
+
+
+def pre_restore(domain, meta):
+    # diverge from the backup so a successful restore is observable
+    _psql(domain, "DROP TABLE IF EXISTS ci_marker;")
+    assert _psql(domain, "SELECT to_regclass('public.ci_marker');") in ("", "NULL"), (
+        "drop did not take"
+    )