feat(2): Q3.2 lasuite-drive base enrollment + nested-subdomain + replicas:0 harness fixes

- harness: services_converged treats replicas:0 one-shot (minio-createbuckets) as
  converged (cur==want); removes the want==0 rejection that hung deploys. DECISIONS.md.
- recipe_meta.EXTRA_ENV flattens MINIO_DOMAIN/COLLABORA_DOMAIN to single-label wildcard
  siblings (the *.ci.commoninternet.net cert covers one label only). DECISIONS.md.
- lifecycle overlays (install/upgrade/backup/restore) + ops.py postgres ci_marker
  data-integrity (db user/name=drive). Parity health_check functional test. PARITY.md.
- DEPS=[keycloak] + OIDC/WOPI/upload functional tests deferred to the SSO iteration
  (probe-before-assert: prove the ~10-service base deploy converges first).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/lasuite-drive/PARITY.md

@@ -0,0 +1,38 @@
+# Parity — lasuite-drive
+
+Phase-2 P2 mapping table. The Adversary cold-verifies parity by reading the source
+`recipe-info/lasuite-drive/tests/<file>` and the cc-ci file side-by-side.
+
+**Enrollment status:** Q3.2 in progress. Base deploy + lifecycle (install/upgrade/backup/restore
+data-integrity) + parity health_check landed first (probe-before-assert: validate the ~10-service
+stack converges with the nested-subdomain flattening before layering SSO). The OIDC + WOPI + upload
+functional tests (which require the keycloak dep + post-deploy migrations + buckets) land in the SSO
+iteration once the base is cold-green. This file is updated as each row lands; nothing is a silent
+omission.
+
+| recipe-maintainer file | cc-ci file | what's verified | status |
+|---|---|---|---|
+| `recipe-info/lasuite-drive/tests/health_check.py` | `tests/lasuite-drive/functional/test_health_check.py` | App serves over HTTPS and returns 200/301/302 from `/`. Port preserves the assertion shape, adapted to the ephemeral per-run domain via `live_app`. | **ported** |
+| `recipe-info/lasuite-drive/tests/oidc_login.py` | `tests/lasuite-drive/functional/test_oidc_with_keycloak.py` (planned, SSO iteration) | Original: Drive `/api/v1.0/authenticate/` redirects to Keycloak → password-grant token → `/api/v1.0/users/me/` returns the user. cc-ci port deploys keycloak as a per-run dep (`DEPS=["keycloak"]`), wires OIDC env via `setup_custom_tests.sh`, exercises discovery + password grant + JWT claims (mirrors the proven lasuite-docs `test_oidc_with_keycloak`). | **pending (SSO iteration)** |
+| `recipe-info/lasuite-drive/tests/wopi_configured.py` | `tests/lasuite-drive/functional/test_wopi_configured.py` (planned) | Original: Collabora + OnlyOffice WOPI discovery endpoints return valid WOPI XML. cc-ci port checks the Collabora discovery XML over the flattened `collabora-<domain>` route (pure HTTP, no browser/SSO). | **pending** |
+| `recipe-info/lasuite-drive/tests/wopi_on_startup.py` | (see DECISIONS / DEFERRED) | Original: greps celery worker container logs for the entrypoint WOPI trigger. cc-ci port via `docker service logs` on the celery service. | **pending** |
+| `recipe-info/lasuite-drive/tests/celery_beat_wopi.py` | (likely DEFERRED — "thorough mode only") | Original sleeps 15–90s waiting for Celery Beat to fire; recipe-maintainer marks it "thorough mode only". Candidate for the `--extra-tests` opt-in (DEFERRED.md), like the matrix-synapse operational ports. | **likely deferred** |
+
+## Recipe-specific tests (Phase-2 P3, ≥2 beyond parity) — planned for SSO iteration
+
+| cc-ci file (planned) | what's verified | rationale |
+|---|---|---|
+| `functional/test_upload_file.py` | Authenticate via the dep keycloak (password grant) → create a workspace/item via Drive's API → upload a file (presigned PUT to the flattened `minio-<domain>` S3 route) → list/download it back, asserting the bytes round-trip. The §4.3-prescribed create-an-object + read-it-back. | Drive's defining behavior is object storage; proves the S3/MinIO path end-to-end (the flattened MINIO_DOMAIN route + bucket created by the one-shot). |
+| `functional/test_wopi_configured.py` | Collabora WOPI discovery XML is served + valid (a distinctive Drive feature: in-browser office editing). | Beyond health: exercises the WOPI/office subsystem, the second characteristic feature. |
+
+## Backup data-integrity (P4) — landed
+
+Exercised by the Phase-1d/1e lifecycle overlays (`tests/lasuite-drive/{test_backup.py,test_restore.py,
+ops.py}`): a `ci_marker` row is seeded in postgres pre-backup, the table dropped pre-restore, and the
+restored DB asserted to match the pre-mutation `original`. Real seed→backup→mutate→restore→assert.
+
+## Non-ports / deferrals
+
+`celery_beat_wopi.py` is recipe-maintainer "thorough mode only" (sleeps up to 90s for a scheduler
+tick) — a candidate for the `--extra-tests` opt-in deferral (DEFERRED.md), consistent with the
+matrix-synapse operational-test deferrals. Confirmed/justified when the SSO iteration lands.