M6.5: enroll cryptpad (recipe #3, stateful/no-DB) + generic per-recipe EXTRA_ENV

Adds a shared-harness EXTRA_ENV mechanism (recipe_meta.py dict or domain-callable),
applied in deploy_app at every deploy path — no per-recipe harness surgery (D5).
cryptpad uses it for its required distinct SANDBOX_DOMAIN. Tests assert data
survival via a marker file in the backed-up cryptpad_data volume (exec_in_app,
since cryptpad data isn't HTTP-served).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

runner/harness/lifecycle.py

@@ -6,6 +6,7 @@ next run. Callers wrap deploy()/teardown() in try/finally (or a pytest finalizer
 from __future__ import annotations
 
 import datetime
+import os
 import re
 import ssl
 import subprocess
@@ -63,12 +64,33 @@ def _stack_age_seconds(stack: str) -> float | None:
     return oldest
 
 
+def _recipe_extra_env(recipe: str, domain: str) -> dict[str, str]:
+    """Per-recipe extra .env keys, applied at every deploy (install + upgrade's old_app) so a recipe
+    with multi-domain / config needs is enrolled with NO shared-harness change (D5/M6.5). A recipe
+    declares `EXTRA_ENV` in tests/<recipe>/recipe_meta.py as either a dict or a callable
+    `EXTRA_ENV(domain) -> dict` (callable form lets it derive values from the per-run domain, e.g.
+    cryptpad's SANDBOX_DOMAIN). Returns {} if none."""
+    path = os.path.join(os.path.dirname(__file__), "..", "..", "tests", recipe, "recipe_meta.py")
+    if not os.path.exists(path):
+        return {}
+    ns: dict = {}
+    with open(path) as fh:
+        exec(compile(fh.read(), path, "exec"), ns)  # noqa: S102 (trusted, in-repo)
+    ee = ns.get("EXTRA_ENV")
+    if callable(ee):
+        ee = ee(domain)
+    return {str(k): str(v) for k, v in (ee or {}).items()}
+
+
 def deploy_app(recipe: str, domain: str, version: str | None = None, secrets: bool = True) -> None:
     """Create + configure + deploy an app. Forces LETS_ENCRYPT_ENV='' so traefik serves the
-    wildcard cert via the file provider and NEVER attempts ACME (adversary finding A1)."""
+    wildcard cert via the file provider and NEVER attempts ACME (adversary finding A1). Applies any
+    per-recipe EXTRA_ENV (recipe_meta.py) before deploy."""
     abra.app_config_remove(domain)  # clear any stale .env from a prior crashed run
     abra.app_new(recipe, domain, version=version, secrets=secrets)
     abra.env_set(domain, "LETS_ENCRYPT_ENV", "")
+    for k, v in _recipe_extra_env(recipe, domain).items():
+        abra.env_set(domain, k, v)
     if secrets:
         abra.secret_generate(domain)
     abra.deploy(domain)