feat(2): Q3.2 lasuite-drive base enrollment + nested-subdomain + replicas:0 harness fixes

- harness: services_converged treats replicas:0 one-shot (minio-createbuckets) as
  converged (cur==want); removes the want==0 rejection that hung deploys. DECISIONS.md.
- recipe_meta.EXTRA_ENV flattens MINIO_DOMAIN/COLLABORA_DOMAIN to single-label wildcard
  siblings (the *.ci.commoninternet.net cert covers one label only). DECISIONS.md.
- lifecycle overlays (install/upgrade/backup/restore) + ops.py postgres ci_marker
  data-integrity (db user/name=drive). Parity health_check functional test. PARITY.md.
- DEPS=[keycloak] + OIDC/WOPI/upload functional tests deferred to the SSO iteration
  (probe-before-assert: prove the ~10-service base deploy converges first).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

runner/harness/lifecycle.py

@@ -181,7 +181,13 @@ def services_converged(domain: str) -> bool:
         return False
     for r in rows:
         cur, _, want = r.partition("/")
-        if not want or cur != want or want == "0":
+        # A service at its DESIRED replica count is converged — including a `replicas: 0`
+        # on-demand one-shot (e.g. lasuite-drive's `minio-createbuckets`, which is scaled up
+        # manually only when buckets need (re)creating), which reports "0/0". The earlier
+        # `want == "0"` rejection wrongly treated those as never-converged, hanging the deploy
+        # forever. `cur == want` (with `want` present) is the correct convergence test; a service
+        # still spinning up shows e.g. "0/1" (cur != want) and is correctly not-yet-converged.
+        if not want or cur != want:
             return False
     return True