cve-check: reconcile is mandatory; do not assume the default branch is main

Skipping the reconcile to keep the sweep 'read-only' was wrong. It researches a
stale checkout, and on the first real run left two recipes with no survey output
at all — indistinguishable from 'no upgrades available' unless you look. The
reconcile is safe precisely because recipe work lives in branches, not on main.

Also documents the trap that produced a false finding in that run: several
coopcloud recipes keep a stale 'main' beside the real default 'master'. gitea's
main is at 1.24.2-rootless while master has 1.27.1-rootless and the merged PRs,
so reading main reports a recipe three releases behind and missing two CVSS-9.8
RCE fixes. Resolve default_branch from the API before reading any file.

And: no output is not 'no upgrade'. It is a third outcome, and only becomes '?'
after the direct registry check has also failed.

.claude/skills/cve-check/SKILL.md

@@ -51,9 +51,22 @@ This is `/recipe-upgrade` step 1's research, stopping before it implements anyth
 >    registry directly for the ones abra could not read, picking the newest tag the app version
 >    supports rather than the numerically highest.
 
-Reconcile the mirror from true upstream first (so you research the real current recipe, not a stale
-mirror), then read versions — **note this is the same reconcile `/upgrade-all` does, and it is
-read-only with respect to the recipe's content**:
+**Reconcile the mirror from true upstream FIRST — ALWAYS, no exceptions.** This is the same reconcile
+`/upgrade-all` does. Do not skip it in the name of keeping the sweep read-only: skipping it makes you
+research a stale checkout, and on the first real run that produced **two recipes with no survey output
+at all**, which is indistinguishable from "no upgrades" unless you check. It is safe — recipe work
+lives in **branches**, never directly on `main`, so a force-sync of `main` to upstream discards
+nothing; it also auto-closes mirror PRs whose changes upstream has already merged.
+
+> ### ⚠️ The default branch may be `master`, not `main` — check, do not assume
+> Several coopcloud recipes keep a **stale `main` alongside the real default `master`**. gitea is one:
+> `main` sits at 1.24.2-rootless while `master` has 1.27.1-rootless plus the merged PRs and the 3.6.3
+> release. Reading `main` there tells you the recipe is three releases behind and missing two CVSS-9.8
+> RCE fixes — a false alarm that reads exactly like a real one. Resolve the default branch from the
+> API (`/api/v1/repos/coop-cloud/<recipe>` → `default_branch`) before reading any file, and never
+> `git reset --hard origin/main` on a checkout that tracks `master`.
+
+Then read versions:
 ```
 set -a; . /srv/cc-ci/.testenv; set +a
 ssh cc-ci "GITEA_USERNAME='$GITEA_USERNAME' GITEA_PASSWORD='$GITEA_PASSWORD' GITEA_URL='$GITEA_URL' bash -s <recipe> --reconcile-only" \
@@ -71,6 +84,12 @@ CRITICAL came from, and an image with no window is not counted at all.
 
 - **No upgrade available** → the recipe is `UPTODATE`; its CVE count is **`0`**, not `?`. There is
   nothing an upgrade could fix. Record it and move on.
+- **No output at all is NOT "no upgrade".** An abra call that times out, FATAs, or prints nothing
+  leaves the recipe **unverified** — treat it as a distinct outcome, never fold it into up-to-date.
+  Re-run it, and if it still yields nothing, resolve the versions by direct registry check (box item 4).
+  Only report `?` once BOTH the abra check and the direct check have failed. On the first real run this
+  distinction was the difference between two false zeros and the truth (both recipes turned out fine,
+  but nothing in the survey said so).
 
 ### 3. Run the advisory scan over that window
 ```