feat(2): Q3.2 lasuite-drive base enrollment + nested-subdomain + replicas:0 harness fixes

- harness: services_converged treats replicas:0 one-shot (minio-createbuckets) as
  converged (cur==want); removes the want==0 rejection that hung deploys. DECISIONS.md.
- recipe_meta.EXTRA_ENV flattens MINIO_DOMAIN/COLLABORA_DOMAIN to single-label wildcard
  siblings (the *.ci.commoninternet.net cert covers one label only). DECISIONS.md.
- lifecycle overlays (install/upgrade/backup/restore) + ops.py postgres ci_marker
  data-integrity (db user/name=drive). Parity health_check functional test. PARITY.md.
- DEPS=[keycloak] + OIDC/WOPI/upload functional tests deferred to the SSO iteration
  (probe-before-assert: prove the ~10-service base deploy converges first).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/lasuite-drive/functional/test_health_check.py

@@ -0,0 +1,30 @@
+"""lasuite-drive — parity port of recipe-maintainer's health_check.py (Phase 2 P2).
+
+SOURCE: references/recipe-maintainer/recipe-info/lasuite-drive/tests/health_check.py
+
+The original asserted HTTP 200 from `https://lasuite-drive.<DOMAIN_SUFFIX>`. The cc-ci port
+preserves the assertion shape — non-error HTTP from the served root — adapted to the ephemeral
+per-run domain via the `live_app` fixture. Runs in the custom tier against the shared post-install
+live deployment.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", "runner"))
+from harness import http as harness_http  # noqa: E402
+
+
+def test_lasuite_drive_returns_200(live_app):
+    """Parity with recipe-info/lasuite-drive/tests/health_check.py: HTTP 200 from `/`."""
+    url = f"https://{live_app}/"
+    # accept 200 (frontend SPA shell) — Drive serves the SPA at root unauthenticated;
+    # the SPA itself bootstraps via /api/v1.0/users/me/ which requires OIDC (separate test).
+    status, _ = harness_http.retry_http_get(
+        url, expect_status=(200, 301, 302), max_wait=60, interval=3
+    )
+    assert status in (200, 301, 302), (
+        f"lasuite-drive at {url} returned HTTP {status} (expected 200/301/302)"
+    )