recipe-upgrade: !testme-on-PR verification + make test PRs opt-in (--with-tests)

Per operator:
- Verify via `!testme` posted ON the recipe PR (the real CI path) so results are
  viewable in the PR; iterate up to 3 !testme runs (fix a real regression + re-test).
  New helper testme-on-pr.sh posts !testme and polls the PR head commit status
  for the verdict (POST=0 to keep polling without re-triggering).
- Test updates are now OPT-IN via `--with-tests`. DEFAULT: recipe PR only using
  existing tests; if a test fails and is genuinely stale, leave an explanatory
  COMMENT on the PR (upgrade looks correct; re-run --with-tests to update tests)
  and do NOT touch any test. --with-tests keeps the verified cc-ci test-update PR
  path (verified via the branch-checkout harness run, since !testme uses prod tests).
- upgrade-all (weekly cron) calls the DEFAULT — never auto-edits tests unattended;
  surfaces "tests look stale" PRs in the summary for the operator to opt in per-recipe.
- New RESULT: SUCCESS-PENDING-TESTS for the recipe-green-but-test-stale default case.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/skills/upgrade-all/SKILL.md

@@ -51,12 +51,18 @@ A table — Recipe | Status (will upgrade / skipped:reason) | Available upgrade(
 For each recipe in `RECIPES_TO_UPGRADE`, spawn an Agent (`subagent_type: "general-purpose"`,
 description `"Upgrade <recipe> on cc-ci"`) with a prompt like:
 
-> Run the `/recipe-upgrade <recipe>` skill end-to-end
-> (`/srv/cc-ci/.claude/skills/recipe-upgrade/SKILL.md`): plan, implement, **verify green on cc-ci**,
-> open a recipe PR, and — only if the upgrade is correct but a cc-ci test went stale — open a verified
-> cc-ci test PR too. Drive cc-ci over `ssh cc-ci`. Do NOT prompt. Do NOT push upstream. Do NOT merge.
-> Print exactly one `RESULT:` line as your final line (the SUCCESS / SUCCESS+TESTPR / FAILED / SKIPPED
-> forms from the recipe-upgrade skill).
+> Run the `/recipe-upgrade <recipe>` skill end-to-end — **DEFAULT mode, do NOT pass `--with-tests`**
+> (`/srv/cc-ci/.claude/skills/recipe-upgrade/SKILL.md`): plan, implement, open a recipe PR, and verify
+> it by posting `!testme` on the PR (results visible in the PR; iterate ≤3×). Use the **existing
+> tests** — if a test fails because it is genuinely stale, **leave an explanatory comment on the PR**
+> for the operator and do NOT modify any test. Drive cc-ci over `ssh cc-ci`. Do NOT prompt. Do NOT push
+> upstream. Do NOT merge. Print exactly one `RESULT:` line as your final line (SUCCESS /
+> SUCCESS-PENDING-TESTS / FAILED / SKIPPED — `SUCCESS+TESTPR` will not occur in default mode).
+
+**Why default (no `--with-tests`):** the weekly cron must never auto-edit cc-ci tests unattended — a
+test change deserves a human decision. So the cron opens recipe PRs only; where a recipe's existing
+test looks stale, the operator sees the explanation in the PR comment and can re-run that one recipe
+with `/recipe-upgrade <recipe> --with-tests` to also get a verified test-update PR.
 
 - **Sequential (default):** one Agent at a time; wait, collect its `RESULT:`, then the next. If the
   Agent tool call itself errors, record `FAILED — agent tool error` and continue. One failure never
@@ -65,8 +71,8 @@ description `"Upgrade <recipe> on cc-ci"`) with a prompt like:
   the results). Failures are isolated per recipe.
 
 ## 4. Collect results
-Parse each final `RESULT:` line into SUCCESS / SUCCESS+TESTPR / FAILED / SKIPPED. A subagent that
-emitted no `RESULT:` line → `FAILED — no result emitted`.
+Parse each final `RESULT:` line into SUCCESS / SUCCESS-PENDING-TESTS / FAILED / SKIPPED (default mode
+won't emit `SUCCESS+TESTPR`). A subagent that emitted no `RESULT:` line → `FAILED — no result emitted`.
 
 ## 5. Write + print the summary
 Write `/srv/cc-ci/.cc-ci-logs/upgrades/upgrade-all-<YYYY-MM-DD>.md` and print it, **leading with the
@@ -74,9 +80,11 @@ PR list** (the actionable output):
 ```markdown
 # cc-ci Weekly Upgrade Run — <YYYY-MM-DD>
 ## Summary
-- Considered: N · Upgraded (PR opened): N · With cc-ci test PR: N · Failed: N · Skipped: N
+- Considered: N · PR green (!testme): N · PR open but tests look stale (commented): N · Failed: N · Skipped: N
 ## PRs to review (NOT merged)
-- <recipe> <old> → <new> — recipe PR: <url>   [+ cc-ci test PR: <url>]
+- <recipe> <old> → <new> — recipe PR: <url> — !testme GREEN
+## PRs where a test looks stale (operator: re-run `--with-tests` to update tests)
+- <recipe> <old> → <new> — recipe PR: <url> — !testme RED on <test>; see PR comment
 ## Failed (investigate)
 - <recipe> — at <step>: <reason>   (log: .cc-ci-logs/upgrades/<recipe>-upgrade-<date>.md)
 ## Skipped