recipe-upgrade: abra recipe release for version bump + upstream release-notes links in PR body

cc-ci recipe-upgrade skill now computes the version via 'abra recipe release --dry-run'
(not a hand-edit) and requires the PR body to link upstream release notes per service.
Bumps the recipe-maintainer submodule pointer to the matching change.

cc-ci-plan/JOURNAL.md

@@ -674,3 +674,14 @@ session cc-ci-orchestrator-stale can be killed; recipe-mirrors org still private
   (13:51:14)** — the old 15-min deadlock is gone. deploy-proxy journal: traefik noop-healthy via
   /api/version → Finished. No failed units; 9/9 infra; endpoints 200. D8 circular-dep DEFINITIVELY
   fixed. Build sequence complete again (pxgate was 15/15).
+
+## 2026-06-15 ~18:30 — recipe-upgrade workflow: abra version bump + release-notes links in PR
+- Operator: (1) upgrade PR comments must link the relevant upstream release notes; (2) stop hand-editing
+  the coop-cloud version label — use `abra recipe release <recipe> -x|-y|-z --dry-run` to COMPUTE the
+  a.b.c+x.y.z (semver per flag + app image tag), apply on the PR branch, never run non-dry-run (it
+  publishes upstream). Verified the syntax + dry-run behavior on the live abra first.
+- Changed cc-ci recipe-upgrade SKILL.md (§2 bump + §3 PR body) and recipe-maintainer (submodule, pushed
+  to notplants/recipe-maintainer main): recipe-upgrade-apply, recipe-new-tag, recipe-create-pr,
+  recipe-upgrade-plan, recipe-upstream. Release-notes URLs come from the per-recipe upstream registry
+  (cc-ci-plan/upstream/<recipe>.md ; recipe-info/<recipe>/upstream.md). Also earlier: used-recipes.md +
+  uptime-kuma marked external (excluded from weekly upgrade).