change(cleanup): reap dev deploys at start+end of /upgrade-all instead of a timer

Per operator: drop the hourly cc-ci-reap-dev-deploys systemd timer; instead run the
dev-* reaper at the START (Step 0, alongside the orphan sweep) and END (new step 4b)
of each /upgrade-all run, with THRESHOLD=0 (the run is quiescent then, so clear all
dev-* unconditionally). The reaper keeps its safe default (4h) for ad-hoc use.
Step-2b mandatory teardown is unchanged (primary mechanism); this is the backstop.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/skills/recipe-upgrade/SKILL.md

@@ -157,9 +157,9 @@ ssh cc-ci 'export PATH=/run/current-system/sw/bin:$PATH; set -a; . /srv/cc-ci/.t
   Then **verify nothing leaked**: `ssh cc-ci 'docker stack ls --format "{{.Name}}" | grep -c "^dev-<recipe with . as _>"'`
   should print `0` (and no `dev-<recipe>_*` volumes remain). If the recipe failed, tear the dev deploy
   down anyway, THEN report the failure — never leave it running.
-  Backstops (defence-in-depth, NOT a substitute for the explicit teardown above): the `/upgrade-all`
-  orphan-sweep (Step 0) and the **hourly `cc-ci-reap-dev-deploys` timer** (reaps idle `dev-*` stacks),
-  so a crashed/abandoned loop's deploy is bounded — but you must still clean up yourself.
+  Backstop (defence-in-depth, NOT a substitute for the explicit teardown above): `/upgrade-all` runs
+  the `dev-*` reaper (`reap-dev-deploys.sh`) + the orphan-sweep at the START and END of every run, so a
+  crashed/abandoned loop's `dev-` deploy is cleared by the next run — but you must still clean up yourself.
 - Caveats: shared swarm — keep to **ONE** `dev-<recipe>` instance at a time and tear it down before the
   next recipe; the `dev-<recipe>` domain is distinct from the harness's per-run domains and from the
   `warm-*` canonicals, so the sweep removes a leaked one without touching live services.