feat(canon): M1.1 tagged-promote gate — canonical only advances to a published release tag

- should_promote_canonical gains a `tagged` requirement (canon §2.A): a green cold
  latest run promotes only when the tested head version is a published release tag;
  an untagged main commit never becomes a canonical.
- warm_reconcile.is_released_version(recipe, version): release-tag membership (exact or
  by version_key). Caller computes `tagged` so the gate stays pure.
- unit tests: untagged -> no promote; is_released_version cases.
- drive-by (pre-existing reds, unrelated to canon, now green): test_warm_reconcile
  traefik assertion was stale vs the phase-pxgate spec (probes /api/version, no
  health_domain); meta.py UPGRADE_BASE_VERSION KEYS help synced to the prevb doc text.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

runner/run_recipe_ci.py

@@ -907,12 +907,18 @@ def run_quick(
     return overall
 
 
-def should_promote_canonical(recipe: str, ref: str | None, overall: int, quick: bool) -> bool:
+def should_promote_canonical(
+    recipe: str, ref: str | None, overall: int, quick: bool, tagged: bool
+) -> bool:
     """WC5 gate (pure): a run advances/seeds the canonical iff the recipe is enrolled
-    (WARM_CANONICAL), the run was GREEN (overall==0), it was COLD (not --quick), and it ran on LATEST
-    (no PR head → `ref` empty: the nightly sweep or a manual `RECIPE=<r>` run). A PR `!testme` carries
-    REF=PR-head and must NOT promote the canonical to a PR's code. Only cold-on-latest advances it."""
-    return canonical.is_enrolled(recipe) and overall == 0 and not quick and not ref
+    (WARM_CANONICAL), the run was GREEN (overall==0), it was COLD (not --quick), it ran on LATEST
+    (no PR head → `ref` empty: the nightly sweep or a manual `RECIPE=<r>` run), AND the tested head
+    version corresponds to a published release TAG (`tagged`, phase canon §2.A). A PR `!testme`
+    carries REF=PR-head and must NOT promote to a PR's code. An UNTAGGED head (a `main` commit with
+    no release tag for its version) must never become a canonical — the canonical is always a real
+    release. `tagged` is computed by the caller via warm_reconcile.is_released_version so this gate
+    stays pure. Only cold-on-latest-and-tagged advances it."""
+    return canonical.is_enrolled(recipe) and overall == 0 and not quick and not ref and tagged
 
 
 def promote_canonical(recipe: str, head_ref: str | None) -> None:
@@ -1482,7 +1488,11 @@ def main() -> int:
     # (WARM_CANONICAL) recipe advances/seeds the canonical. ONLY cold-on-latest advances it (a PR
     # `!testme` carries REF and must NOT promote; `--quick` never promotes — handled in run_quick).
     # Non-fatal: a promote failure leaves the OLD known-good intact (never lose it) and is logged.
-    if should_promote_canonical(recipe, ref, overall, quick=False):
+    # canon §2.A tagged-promote gate: only promote when the tested head version is a published
+    # release tag (never an arbitrary untagged `main` commit). head_version is the compose `version`
+    # label of the code under test; is_released_version checks it against the recipe's release tags.
+    tagged = warm_reconcile.is_released_version(recipe, head_version)
+    if should_promote_canonical(recipe, ref, overall, quick=False, tagged=tagged):
         try:
             promote_canonical(recipe, head_ref)
         except Exception as e:  # noqa: BLE001 — promote is a post-green bonus; never fail a green run