feat(1d): G0 — generic install + deploy-once orchestrator (DG1 green on hedgedoc)

- harness/generic.py: recipe-agnostic assert_serving (converged + real HTTP, 404-excluded +
  not Traefik 404 body + CA-verified trusted wildcard cert), op helpers, backup_capable detect
- harness/discovery.py: per-op overlay resolution (repo-local > cc-ci > generic), custom + hook
- tests/_generic/: assertion-only tiers (install/upgrade/backup/restore) on the shared deployment
- run_recipe_ci.py: deploy-ONCE orchestrator, per-op summary, deploy-count guard (DG4.1)
- conftest live_app fixture; lifecycle deploy-count + install-steps hook + pin DOMAIN to run domain

DG1 cold-verified green on hedgedoc (pure generic, deploy-count=1, clean teardown). G0 CLAIMED.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/conftest.py

@@ -61,6 +61,17 @@ def meta(recipe) -> dict:
     return _recipe_meta(recipe)
 
 
+@pytest.fixture(scope="session")
+def live_app() -> str:
+    """Phase 1d shared-deployment contract: the orchestrator deploys ONCE and runs each tier
+    (generic or overlay) as its own pytest invocation against that single live deployment, passing
+    its domain in CCCI_APP_DOMAIN. Tiers are assertion-only (and lifecycle ops mutate in place) —
+    they NEVER deploy or tear down. This guarantees one deploy + one teardown per run (DG4.1)."""
+    domain = os.environ.get("CCCI_APP_DOMAIN")
+    assert domain, "CCCI_APP_DOMAIN not set — a tier must run under the deploy-once orchestrator"
+    return domain
+
+
 def _wait_healthy(domain, meta):
     lifecycle.wait_healthy(
         domain,