M6.5: cryptpad (recipe #3) full 3-stage green on host; record set_env/RESTIC backup fix

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

BACKLOG.md

@@ -78,7 +78,15 @@ Two single-writer sections (§6.1): Builder edits only `## Build backlog`; Adver
       build #39 success (~31m): install 2✓ (realm health + Playwright admin login), upgrade 1✓
       (`test_upgrade_preserves_realm` — DB data survives), backup 1✓ (`test_backup_mutate_restore`).
       Clean teardown (0 keyc services/volumes). Proves DB-backed data survival + integration path.
-- [ ] Enroll recipes 3–6 covering remaining D10 categories, no harness surgery
+- [x] cryptpad (stateful/no-DB, recipe #3) full 3-stage green on host (cc-ci-run): install 2✓
+      (http + Playwright), upgrade 1✓ (marker in cryptpad_data survives), backup 1✓
+      (`test_backup_mutate_restore`). No harness surgery — added generic per-recipe EXTRA_ENV
+      (handles cryptpad's SANDBOX_DOMAIN). Fixed a real backup bug en route: set_env glued
+      RESTIC_REPOSITORY onto a comment → backupbot had no restic repo (now newline-safe). Drone
+      canonical run = build #46 (in flight).
+- [ ] Enroll recipes 4–6 covering remaining D10 categories (multi-service+S3, large-volume,
+      TLS-passthrough), no harness surgery
+- [ ] Re-verify keycloak backup post set_env fix (build #39 ran off an earlier backupbot deploy)
 - [ ] Gate: M6.5 — recipes 3–6 three-stage green
 
 ### M7 — Secrets hardening (D6)