feat(survey): don't skip recipes on abra tag+digest FATA — check upstream directly

abra hard-FATAs on image refs with both a tag and a digest (immich:
postgres:14-vectorchord...@sha256:..., valkey:9@sha256:...), aborting the whole
recipe survey so immich was silently dropped. Per operator: don't normalize the
recipe; catch the failure and check the upstream registry directly.

- /upgrade-all box item 4: a tag+digest parse FATA is NOT not-fetchable. Use abra
  for the images it parses; for the rest, list upstream tags (Docker Hub / ghcr /
  buildx imagetools) and judge availability (match the variant the app supports,
  not blindly the max). Upgradeable if abra OR the direct check finds a newer tag.
- /recipe-upgrade implement: hand-bump tag+digest pins (abra can't), and re-resolve
  + re-append the digest for the new tag so the pin is preserved (never drop it).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/skills/recipe-upgrade/SKILL.md

@@ -106,6 +106,15 @@ On cc-ci's `~/.abra/recipes/<recipe>` (wrap every abra call per the pseudo-TTY b
 `ssh cc-ci 'script -qec "abra … -n" /dev/null'`):
 - `script -qec "abra recipe upgrade <recipe> -n" /dev/null` for the tags it can bump; hand-edit
   `compose.yml` for any tags it won't, plus the config/env/volume/label changes the plan calls for.
+- **tag+digest pins (`image:tag@sha256:…`) — abra can't bump these (it FATAs `tag and digest … not
+  supported`), so do it by hand, and KEEP the digest pin:** decide the new tag from the direct
+  upstream-tag check (see `/upgrade-all` box item 4 — list the registry tags, pick the newest one the
+  app version supports; do not blindly take the max). Then **re-resolve the digest for the new tag** and
+  re-append it so the pin style is preserved (a digest is a reproducibility/security pin — never silently
+  drop it): `docker buildx imagetools inspect <image>:<newtag> --format '{{.Manifest.Digest}}'` (or
+  `docker manifest inspect`), then write `image: <image>:<newtag>@<newdigest>`. If the app and its
+  digest-pinned sidecars must move together (e.g. immich-server ↔ its `postgres:…-vectorchord…` DB),
+  bump them as a matched, compatibility-checked set per the plan.
 - Bump the `coop-cloud.${STACK_NAME}.version` label to the new version string from the plan.
 - `script -qec "abra recipe lint <recipe> -C -n" /dev/null` — fix obvious lint errors; if unfixable,
   record it and continue.