watchdog: one-shot /upgrade-all trigger on phase-sequence completion

When LOG_DIR/.run-upgrade-on-complete exists, the watchdog launches
launch-upgrader.py start the moment the last phase reaches ## DONE (then
consumes the flag). Lets the operator replace a scheduled weekly cron run with
'run as soon as the current phase queue finishes' — used tonight: the
cc-ci-upgrade-all.timer was stopped (stamp forwarded past tonight's slot) and
this flag set instead.

cc-ci-plan/launch.py

@@ -770,6 +770,18 @@ def watchdog_loop():
                     Path(LOG_DIR, "SEQUENCE-COMPLETE").write_text(
                         f"cc-ci phase sequence complete {ts}. Phases: {all_ids()}. "
                         f"Loops stopped; entire build finished.\n")
+                    # One-shot: if the operator queued an upgrade to follow the phase run
+                    # (touch LOG_DIR/.run-upgrade-on-complete), launch /upgrade-all now in
+                    # place of the weekly cron. Flag is consumed so it never repeats.
+                    trigger = Path(LOG_DIR) / ".run-upgrade-on-complete"
+                    if trigger.exists():
+                        trigger.unlink()
+                        log("upgrade-on-complete flag set — launching /upgrade-all")
+                        subprocess.run(
+                            ["python3", f"{PLAN_DIR}/launch-upgrader.py", "start"],
+                            env={**os.environ,
+                                 "PATH": "/home/loops/.local/bin:" + os.environ.get("PATH", "")},
+                            capture_output=True)
                     log("watchdog exiting.")
                     return
             else: