skills: PR-merge policy + test-before-switch + new /cc-ci-orchestrator-update

- cc-ci-server-update / cc-ci-tests-update / cc-ci-update: operator policy change —
  open PRs for visibility/historical record and merge directly once verified
  (invocation = authorization); reports must list merged-PR links + change summaries.
  (tests-update still never merges the paired recipe upgrade PRs.)
- cc-ci-server-update: mandatory nixos-rebuild test step (5d) before switch, with
  detached-activation + transient-unit notes from the 2026-08-03 26.05 deploy.
- AGENTS.md: test-before-switch policy for orchestrator host rebuilds.
- NEW skill cc-ci-orchestrator-update (+ thin .claude wrapper): the /cc-ci-server-update
  analogue for this host (flake /srv/cc-ci-orch, .#cc-ci-orchestrator-hetzner, Hetzner
  server 134487234), with self-update caveats.
- JOURNAL.md: 2026-08-03 server-update incident/recovery handoff entry.

AGENTS.md

@@ -36,7 +36,12 @@ a **Hetzner `cpx22`** cloud server (`cc-ci-orchestrator-1`, tailnet `100.84.190.
 `168.119.126.100`, flake host `cc-ci-orchestrator-hetzner`) — see
 `cc-ci-plan/plan-orchestrator-hetzner-migration.md`. The earlier Pi→Incus-VM move is the historical
 `cc-ci-plan/plan-orchestrator-migration.md`. Rebuild this host with
-`nixos-rebuild switch --flake .#cc-ci-orchestrator-hetzner` from `/srv/cc-ci-orch`.
+`nixos-rebuild switch --flake .#cc-ci-orchestrator-hetzner` from `/srv/cc-ci-orch` — but **always
+`nixos-rebuild test` the same flake target first and verify the host is still healthy/reachable
+before the `switch`** (general policy for nix deploys to this host and the cc-ci server: `test`
+leaves the bootloader and system profile untouched, so a reboot always recovers to the
+last-known-good generation; the 2026-08-03 cc-ci 26.05 bump outage is the cautionary tale, see
+`.cc-ci-logs/server-update-2026-08-03.md`).
 
 ## Keep the orchestrator open, under remote-control