feat(upgrade-all): sweep orphans from previous runs at the start of each weekly run

Adds sweep-orphans.sh (safe-by-allowlist: removes orphan test stacks, standalone
debug containers >30m old, leaked dangling volumes, and reparented docker-run
wrappers; spares infra + warm-* canonicals and their retained volumes) and wires
it as Step 0 of /upgrade-all so a prior run's leaked stack/container/process can't
contend for the shared Swarm or skew the survey. Idempotent; no-op when clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/skills/upgrade-all/SKILL.md

@@ -25,6 +25,20 @@ session, but the agent is the intended path so the weekly run isn't buried in he
 - `--dry-run` → survey + print what WOULD upgrade; spawn nothing.
 - `--parallel` → fan out all per-recipe subagents at once (faster, more host load — see safety below).
 
+## 0. Sweep orphans from previous runs (FIRST, before anything else)
+A prior run's teardown can crash, an agent can be killed mid-deploy, or a manual debug probe can be
+left running — leaving an orphan test stack, a standalone debug container, leaked volumes, or a stuck
+`docker run` wrapper that contends for the shared Swarm and skews the survey. Clear them before
+surveying. The sweep is **safe by allowlist** — it removes only what is NOT infra (traefik/drone/
+backups/the `ccci-*` control plane) and NOT a `warm-*` canonical (whose retained volumes are spared),
+so it can never take down a live service:
+```
+ssh cc-ci 'bash -s' < /srv/cc-ci/.claude/skills/upgrade-all/sweep-orphans.sh
+```
+It is idempotent (a no-op when the host is already clean) and prints what it removed plus the
+surviving Swarm services (which should be infra + `warm-*` only — eyeball that before continuing). If
+anything legitimate looks at risk, stop and investigate rather than proceeding.
+
 ## 1. Build the candidate list
 Enrolled recipes = the cc-ci `tests/<recipe>/` dirs (same set `ci-test-review` sweeps):
 ```