harness: app_new uses chaos only when no version (version => clean tag checkout)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

runner/harness/abra.py

@@ -47,11 +47,14 @@ def _run(args: list[str], timeout: int = 300, check: bool = True) -> subprocess.
 def app_new(recipe: str, domain: str, server: str = "default", version: Optional[str] = None,
             secrets: bool = False) -> None:
     args = ["app", "new", recipe]
+    args += ["-s", server, "-D", domain, "-o", "-n"]
     if version:
+        # pin to a published version tag (e.g. upgrade's previous-version deploy) — a clean tag
+        # checkout, which is incompatible with chaos.
         args.append(version)
-    # -C (chaos): deploy the recipe AT THE CURRENT CHECKOUT (the PR head under test), not a
-    # re-resolved version tag. -o (offline): don't fetch tags from the (private) remote.
-    args += ["-s", server, "-D", domain, "-C", "-o", "-n"]
+    else:
+        # -C (chaos): deploy the recipe AT THE CURRENT CHECKOUT (the PR head under test).
+        args.append("-C")
     if secrets:
         args.append("-S")
     _run(args)