fix(lasuite-drive): re-assert SECRET_COLLABORA_P_VERSION in EXTRA_ENV

abra's pinned-version 'app new' regenerates the app .env from generation
hints and drops SECRET_COLLABORA_P_VERSION (the .env.sample ships the line
manually — not a generatable secret). Every secret-touching abra command
for the app then FATAs 'missing version for secret? (collabora_p)' and the
cold base deploy goes RED at install (first seen in the 2026-10-25 weekly
sweep's cold tests of the new releases: lasuite-drive never got past
install_steps' oidc_rpcs insert). Re-asserting the shipped version pin via
EXTRA_ENV restores the sample's contract.

Verified live on cc-ci: abra app check passes for the pinned sample env
collabora_p only with the line present; repro via 'abra app new -S' on
0.12.0+v0.21.0 dropped the line deterministically.

tests/lasuite-drive/recipe_meta.py

@@ -59,6 +59,13 @@ def EXTRA_ENV(ctx):
         # postgres, redis, collabora ~1GB, onlyoffice ~2GB). Bump so abra waits long enough for
         # convergence; kept under DEPLOY_TIMEOUT (1800) so Python never kills abra mid-wait.
         "TIMEOUT": "1500",
+        # abra's pinned-version `app new` regenerates the .env from generation hints and DROPS
+        # SECRET_COLLABORA_P_VERSION (not a generatable secret — the .env.sample ships its
+        # version line manually). Without it every secret-touching abra command for the app
+        # FATAs "missing version for secret? (collabora_p)" → the base deploy goes RED at
+        # install. env_set runs after app_new, so re-asserting the shipped version pin here
+        # restores the sample's contract.
+        "SECRET_COLLABORA_P_VERSION": "v1",
     }
 
 

tests/unit/test_meta.py

@@ -171,6 +171,22 @@ def test_extra_env_dict_and_callable_forms(tmp_path):
     assert meta_mod.extra_env(meta2, ctx2) == {}  # unset EXTRA_ENV resolves to {}
 
 
+TESTS_DIR = os.path.join(os.path.dirname(__file__), "..")
+
+
+def test_lasuite_drive_extra_env_carries_collabora_p_version():
+    """(REGRESSION, 2026-10-25) abra's pinned-version `app new` regenerates the .env from
+    generation hints and drops SECRET_COLLABORA_P_VERSION (the .env.sample ships it manually),
+    so every secret-touching abra command for the app FATAs "missing version for secret?
+    (collabora_p)" and the cold base deploy goes RED at install. The per-recipe EXTRA_ENV must
+    re-assert the shipped version pin (env_set runs after app_new). Pin it here so abra/upstream
+    drift that loses it again surfaces as a red unit test, not a weekly red build."""
+    meta = meta_mod.load("lasuite-drive", tests_dir=TESTS_DIR)
+    ctx = meta_mod.hook_ctx("lasuite-drive-pr0-abc123.ci.commoninternet.net", meta)
+    extra = meta_mod.extra_env(meta, ctx)
+    assert extra.get("SECRET_COLLABORA_P_VERSION") == "v1"
+
+
 # ---- P3: uniform ctx hook convention -------------------------------------------------------------