fix(2): recipe_checkout force (-f) — fixes mumble upgrade-tier checkout collision with cc-ci overlay

git checkout <head_ref> aborted on the untracked install_steps-provided compose.host-ports.yml (which
head_ref tracks). Force-checkout yields the exact ref tree. Also fixes the mumble restore tier: backup
labels exist only in 1.0.0+, so backup/restore are meaningful only after the (now-working) upgrade moves
the app to head_ref. DECISIONS.md updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

runner/harness/abra.py

@@ -80,7 +80,13 @@ def recipe_checkout(recipe: str, version: str) -> None:
     import os
 
     path = os.path.expanduser(f"~/.abra/recipes/{recipe}")
-    subprocess.run(["git", "-C", path, "checkout", "--quiet", version], check=True)
+    # -f (force): the version-pinning checkout must yield the EXACT ref tree. Without it, a cc-ci
+    # install_steps-provided overlay (e.g. mumble's compose.host-ports.yml, copied into a version that
+    # predates it) is an UNTRACKED file that collides with the same path TRACKED in a later ref, and
+    # `git checkout <ref>` aborts ("untracked working tree files would be overwritten"). Force resolves
+    # it by writing the ref's tracked version. Safe: we never want local recipe-tree state preserved
+    # across a version switch (and chaos deploys re-provide the overlay via install_steps when needed).
+    subprocess.run(["git", "-C", path, "checkout", "-f", "--quiet", version], check=True)
 
 
 def has_lightweight_version_tags(recipe: str) -> bool: