M6.5: enroll cryptpad (recipe #3, stateful/no-DB) + generic per-recipe EXTRA_ENV

Adds a shared-harness EXTRA_ENV mechanism (recipe_meta.py dict or domain-callable),
applied in deploy_app at every deploy path — no per-recipe harness surgery (D5).
cryptpad uses it for its required distinct SANDBOX_DOMAIN. Tests assert data
survival via a marker file in the backed-up cryptpad_data volume (exec_in_app,
since cryptpad data isn't HTTP-served).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/cryptpad/recipe_meta.py

@@ -0,0 +1,15 @@
+# Per-recipe harness config for cryptpad (recipe #3 — stateful, no external DB; data on disk
+# volumes). Enrolling needs NO shared-harness change (D5): the SANDBOX_DOMAIN quirk is handled by
+# the generic EXTRA_ENV mechanism in lifecycle.deploy_app.
+HEALTH_PATH = "/"
+HEALTH_OK = (200, 301, 302)
+DEPLOY_TIMEOUT = 600
+HTTP_TIMEOUT = 600
+
+
+def EXTRA_ENV(domain):
+    """cryptpad needs a SANDBOX_DOMAIN distinct from the main DOMAIN (it serves user content from a
+    separate origin; the web router routes both). Derive a sibling subdomain under the same wildcard
+    (covered by the wildcard cert, so no cert work)."""
+    label, _, rest = domain.partition(".")
+    return {"SANDBOX_DOMAIN": f"{label}-sb.{rest}"}