Resolve the recipe branch/ref to its head commit sha via the Gitea API before invoking the cold full-suite run, so the upgrade tier deploys the exact PR head. From the phase-5 upgrade-flow verification. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>