cctest-recipe-upstream: support non-sandboxed execution (anonymous git/API access)

.opencode/skills/cctest-recipe-upstream/SKILL.md

@@ -24,3 +24,32 @@ run `/cctest-intro` / `/cctest-setup-sandbox` first.
   timers) from an ARM skill — cc-ci work goes through the cc-ci skills.
 - The submodule is **pinned**: don't commit into it from here; upstream ARM changes arrive via
   a deliberate submodule bump + `scripts/gen-cctest-skills.py` regeneration.
+
+**Sandboxed vs non-sandboxed mode.** This skill needs only git + (optionally) the Gitea API —
+not the test server — so it can run either way. Probe, then follow that branch:
+
+- **Sandboxed** (ARM env configured: `test-ssh/.testenv` with `GITEA_USERNAME`/`GITEA_PASSWORD`/
+  `GITEA_URL`, sandbox/test instances): the canonical `recipe-upstream` script in
+  `references/recipe-maintainer/.claude/commands/recipe-upstream.md` runs as written. Note its
+  WORKSPACE probing expects `/workspace` or `~/Documents/recipe-maintainer`; on a bare host pass
+  the submodule dir explicitly instead.
+- **Non-sandboxed** (no ARM env on the host — e.g. the orchestrator, where the recipe-maintainer
+  checkout is only a pinned submodule): no sandbox/test instances are needed and NONE of the
+  setup skills are. Recipe-maintainer mirrors on `git.autonomic.zone` are publicly readable, so:
+  1. Check out the recipe if missing: `abra recipe fetch <recipe>` (lands in `~/.abra/recipes/<recipe>`)
+     — or a plain anonymous `git clone https://git.autonomic.zone/recipe-maintainers/<recipe>.git`
+     if abra is unavailable.
+  2. Fetch the PR head branch from the mirror **anonymously** — no credentials in the remote URL:
+     `git remote add gitea https://git.autonomic.zone/recipe-maintainers/<recipe>.git`
+     (remote update rather than re-add if it exists), then
+     `git fetch gitea +refs/pull/<N>/head:refs/heads/<head_ref>`.
+  3. Fetch PR metadata (head/base refs, merged flag, release bump line) from
+     `https://git.autonomic.zone/api/v1/repos/recipe-maintainers/<recipe>/pulls/<N>` —
+     unauthenticated; use bot creds only if the repo turns out to be private (orchestrator hosts
+     can read them from `/srv/cc-ci-orch/.testenv` — never written anywhere else).
+  4. Everything else in the canonical script (origin/dev remote setup, release recommendation,
+     emitted next-steps) is identical.
+
+In both modes the final output is a set of commands for the operator to run on a machine **with
+push access to `git.coopcloud.tech`** — always print them, even when everything local is
+already prepared.