canonical_domain() routes any recipe in warm.WARM_DOMAINS (keycloak) to a distinct warm-canon-<recipe> domain so the data-warm canonical promote can never collide with the live-warm OIDC provider at warm-keycloak. keycloak WARM_CANONICAL=True (full canonical coverage without risking live SSO).