feat(recipe-report): /recipe-report skill + helper + launcher (default opus); wire into upgrade-all

- recipe-report.py: survey (run + per-recipe PRs + CI verdicts) / render (spec->HTML) / publish
  (copy to cc-ci:/var/lib/cc-ci-reports + regen index).
- skill .claude/skills/recipe-report: review the weekly run, classify needs-attention vs routine,
  publish one public HTML page per week + index at report.ci.commoninternet.net. Read-only.
- launch-report.py: one-shot cc-ci-report agent, REPORT_MODEL default opus (separate from the
  sonnet upgrader), REPORT_BACKEND default claude.
- upgrade-all SKILL: closing step launches the report agent.
Serving (nix/modules/reports.nix) already deployed + live.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/skills/upgrade-all/SKILL.md

@@ -115,6 +115,12 @@ PR list** (the actionable output):
 ```
 End with the report path and a reminder that **nothing was merged**.
 
+## 6. Launch the public Recipe Report
+Once the summary is written, kick off the weekly public report (its own agent, separate model — default
+opus): `python3 /srv/cc-ci/cc-ci-plan/launch-report.py start`. It runs `/recipe-report`, reviews this
+run + the live recipe/PR state, and publishes to https://report.ci.commoninternet.net. Fire-and-forget
+— it runs independently; you can then go idle.
+
 ## Safety / coordination (this matters — shared host with the build loops)
 - **Sequential is the default for a reason.** Recipe deploys are **stateful on the shared Swarm** and
   parallel deploys can OOM/collide. Between sequential recipes, the per-recipe `recipe-upgrade` tears