upgrade-all: skip 'external' recipes (uptime-kuma) + add used-recipes.md inventory

Operator: uptime-kuma is maintained elsewhere — drop it from the weekly upgrade
but keep it in the used-recipes inventory. New cc-ci-plan/used-recipes.md is the
canonical list of every recipe cc-ci deploys/tests, with a weekly|external tier;
upgrade-all §1 now excludes 'external' rows from the candidate list (explicit
--args still override). uptime-kuma = external; all others weekly.

.claude/skills/upgrade-all/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: upgrade-all
-description: Weekly autonomous upgrade run for the cc-ci CI server. Surveys every enrolled recipe for available upstream upgrades, then runs /recipe-upgrade on each upgradeable one via a subagent — plan, implement, verify green on cc-ci, open a recipe PR (and, only if a cc-ci test went stale, a verified cc-ci test PR). Collects results into one summary listing every PR to review. Rolling pool by default — works through recipes ALPHABETICALLY keeping DRONE_RUNNER_CAPACITY (the drone runner's slots, currently 2) subagents running at once, starting the next as each finishes; --sequential for one-at-a-time, --capacity N to override the pool size, --parallel to start all at once, --dry-run to preview. NEVER merges. Built to run once weekly on a cron. Invoke as /upgrade-all.
+description: Weekly autonomous upgrade run for the cc-ci CI server. Surveys every enrolled recipe (except those tagged `external` in cc-ci-plan/used-recipes.md — used/tested but maintained elsewhere, e.g. uptime-kuma) for available upstream upgrades, then runs /recipe-upgrade on each upgradeable one via a subagent — plan, implement, verify green on cc-ci, open a recipe PR (and, only if a cc-ci test went stale, a verified cc-ci test PR). Collects results into one summary listing every PR to review. Rolling pool by default — works through recipes ALPHABETICALLY keeping DRONE_RUNNER_CAPACITY (the drone runner's slots, currently 2) subagents running at once, starting the next as each finishes; --sequential for one-at-a-time, --capacity N to override the pool size, --parallel to start all at once, --dry-run to preview. NEVER merges. Built to run once weekly on a cron. Invoke as /upgrade-all.
 ---
 
 # upgrade-all
@@ -82,11 +82,20 @@ remains as belt-and-suspenders even after the /16 fix: it fires on the exact err
 docker to reclaim leaked endpoints if VIP exhaustion ever recurs despite the larger subnet.)
 
 ## 1. Build the candidate list
-Enrolled recipes = the cc-ci `tests/<recipe>/` dirs (same set `ci-test-review` sweeps):
+Enrolled recipes = the cc-ci `tests/<recipe>/` dirs (same set `ci-test-review` sweeps), **MINUS any
+recipe tagged `external` in `cc-ci-plan/used-recipes.md`** — recipes cc-ci uses/tests but does NOT
+maintain (someone else upgrades them, e.g. **uptime-kuma**). `used-recipes.md` is the canonical
+inventory of every recipe we use; only its `weekly` rows get an upgrade survey + PR here.
 ```
-ssh cc-ci 'cd /root/cc-ci/tests && ls -d */' | sed 's#/##' | grep -vE '^(_generic|unit|__pycache__)$'
+EXTERNAL=$(awk '!/^[[:space:]]*#/ && $2=="external"{print $1}' /srv/cc-ci/cc-ci-plan/used-recipes.md)
+ssh cc-ci 'cd /root/cc-ci/tests && ls -d */' | sed 's#/##' \
+  | grep -vE '^(_generic|unit|__pycache__)$' \
+  | grep -vxF -f <(printf '%s\n' "$EXTERNAL")    # drop externally-maintained recipes
 ```
-(or the names passed in `$ARGUMENTS`). For each, on cc-ci, check availability — skip dirty/up-to-date.
+(or the names passed in `$ARGUMENTS` — an explicit recipe name overrides the `external` skip, so you
+can still upgrade one on request.) For each candidate, on cc-ci, check availability — skip
+dirty/up-to-date. (If `/root/cc-ci` isn't present on the host, stage it first — see
+`cc-ci-plan/plan-proxy-vip-exhaustion-fix.md` / the host-rebuild memory for the staging step.)
 
 > ⚠️ **Four things that silently skip recipes — handle ALL FOUR per recipe before the version check:**
 > 1. **pseudo-TTY:** abra FATAs `inappropriate ioctl for device` under plain ssh — wrap every abra call