feat(canon): M1.1 tagged-promote gate — canonical only advances to a published release tag

- should_promote_canonical gains a `tagged` requirement (canon §2.A): a green cold
  latest run promotes only when the tested head version is a published release tag;
  an untagged main commit never becomes a canonical.
- warm_reconcile.is_released_version(recipe, version): release-tag membership (exact or
  by version_key). Caller computes `tagged` so the gate stays pure.
- unit tests: untagged -> no promote; is_released_version cases.
- drive-by (pre-existing reds, unrelated to canon, now green): test_warm_reconcile
  traefik assertion was stale vs the phase-pxgate spec (probes /api/version, no
  health_domain); meta.py UPGRADE_BASE_VERSION KEYS help synced to the prevb doc text.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_promote.py

@@ -2,7 +2,8 @@
 
 Pure predicate. The live promote (deploy canonical at latest → snapshot → registry) is proven on
 custom-html (W3). is_enrolled is monkeypatched so the test doesn't depend on which recipes are
-enrolled on disk.
+enrolled on disk. canon §2.A adds the `tagged` requirement: a promote also requires the tested head
+version to be a published release tag (computed by the caller via is_released_version).
 """
 
 from __future__ import annotations
@@ -20,30 +21,40 @@ def _enrolled(monkeypatch, val):
     monkeypatch.setattr(canonical, "is_enrolled", lambda r: val)
 
 
-def test_promote_when_enrolled_green_cold_latest(monkeypatch):
+def test_promote_when_enrolled_green_cold_latest_tagged(monkeypatch):
     _enrolled(monkeypatch, True)
-    # green (overall 0), cold (quick False), latest (ref None) → promote
-    assert rr.should_promote_canonical("custom-html", None, 0, quick=False) is True
-    assert rr.should_promote_canonical("custom-html", "", 0, quick=False) is True
+    # green (overall 0), cold (quick False), latest (ref None), tagged → promote
+    assert rr.should_promote_canonical("custom-html", None, 0, quick=False, tagged=True) is True
+    assert rr.should_promote_canonical("custom-html", "", 0, quick=False, tagged=True) is True
 
 
 def test_no_promote_when_not_enrolled(monkeypatch):
     _enrolled(monkeypatch, False)
-    assert rr.should_promote_canonical("hedgedoc", None, 0, quick=False) is False
+    assert rr.should_promote_canonical("hedgedoc", None, 0, quick=False, tagged=True) is False
 
 
 def test_no_promote_when_red(monkeypatch):
     _enrolled(monkeypatch, True)
-    assert rr.should_promote_canonical("custom-html", None, 1, quick=False) is False
+    assert rr.should_promote_canonical("custom-html", None, 1, quick=False, tagged=True) is False
 
 
 def test_no_promote_when_quick(monkeypatch):
     # --quick never promotes (the canonical advances ONLY via cold)
     _enrolled(monkeypatch, True)
-    assert rr.should_promote_canonical("custom-html", None, 0, quick=True) is False
+    assert rr.should_promote_canonical("custom-html", None, 0, quick=True, tagged=True) is False
 
 
 def test_no_promote_on_pr_head(monkeypatch):
     # a PR `!testme` carries REF=PR-head → must NOT advance the canonical to a PR's code
     _enrolled(monkeypatch, True)
-    assert rr.should_promote_canonical("custom-html", "abc123def", 0, quick=False) is False
+    assert (
+        rr.should_promote_canonical("custom-html", "abc123def", 0, quick=False, tagged=True)
+        is False
+    )
+
+
+def test_no_promote_when_untagged(monkeypatch):
+    # canon §2.A: a green cold latest run on an UNTAGGED state (head version is not a release tag)
+    # must NOT promote — the canonical is always a real release, never an arbitrary main commit.
+    _enrolled(monkeypatch, True)
+    assert rr.should_promote_canonical("custom-html", None, 0, quick=False, tagged=False) is False