feat(1d): G0 — generic install + deploy-once orchestrator (DG1 green on hedgedoc)

- harness/generic.py: recipe-agnostic assert_serving (converged + real HTTP, 404-excluded +
  not Traefik 404 body + CA-verified trusted wildcard cert), op helpers, backup_capable detect
- harness/discovery.py: per-op overlay resolution (repo-local > cc-ci > generic), custom + hook
- tests/_generic/: assertion-only tiers (install/upgrade/backup/restore) on the shared deployment
- run_recipe_ci.py: deploy-ONCE orchestrator, per-op summary, deploy-count guard (DG4.1)
- conftest live_app fixture; lifecycle deploy-count + install-steps hook + pin DOMAIN to run domain

DG1 cold-verified green on hedgedoc (pure generic, deploy-count=1, clean teardown). G0 CLAIMED.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/_generic/test_install.py

@@ -0,0 +1,16 @@
+"""Generic INSTALL tier (Phase 1d DG1) — recipe-agnostic.
+
+The orchestrator has already deployed the app ONCE (deploy-once, DG4.1) and waited for it to
+converge. This tier asserts the app is ACTUALLY SERVING over real HTTPS through Traefik — not a
+404 fallback, not the default cert, not health-only. Runs for ANY recipe that ships no
+test_install.py overlay (the invariant: no overlay ⇒ generic runs)."""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+from harness import generic  # noqa: E402
+
+
+def test_serving(live_app, meta):
+    generic.assert_serving(live_app, meta)