status(gtea): M2 blockers fixed; CI builds #681/#682 in flight

- Consumed BUILDER-INBOX (M2 blockers from Adversary @20:50Z)
- Fixed all 3 blockers in commit a121d2c:
  1. LFS test fails: UPGRADE_EXTRA_ENV + secret generation in upgrade path
  2. REF=main HC1 fail: always use git SHA for head_ref
  3. Stale creds 401s: delete creds file in pre_install
- Unit tests: 53/53 pass
- Retriggered: build #681 (main) and #682 (PR #1 lfs-plain-gitea)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

machine-docs/BACKLOG-gtea.md

@@ -13,12 +13,14 @@
 - [x] 4. Verify LFS test correctly skips on main (compose.lfs.yml absent)
       SKIPPED with expected message in run 846690. PASS.
 - [x] 5. CLAIM M1 — ADVERSARY PASS @2026-06-15T20:32Z (commit a106036)
-- [ ] 6. Run full harness via real CI / !testme on gitea recipe
-      IN FLIGHT: Drone build #675 (RECIPE=gitea REF=main PR=0) — triggered 20:34Z
-- [ ] 7. Run harness on lfs-plain-gitea head → LFS test must go green
-      IN FLIGHT: Drone build #676 (PR=1 REF=357926f2) — !testme posted 20:34Z
+- [~] 6. Run full harness via real CI / !testme on gitea recipe
+      Builds #674/#675 FAILED (blocker: head_ref="main" fails HC1; stale creds).
+      FIXED in commit a121d2c. Retriggered as build #681 (RECIPE=gitea REF=main PR=0) @21:00Z
+- [~] 7. Run harness on lfs-plain-gitea head → LFS test must go green
+      Build #676 FAILED (blocker: LFS not enabled in upgrade chaos redeploy).
+      FIXED in commit a121d2c. Retriggered as build #682 (PR=1 REF=357926f2) @21:00Z
 - [x] 8. Post !testme on PR #1 so result lands in PR
-      DONE (posted 20:34Z, build #676, PENDING)
+      DONE (posted 20:34Z, build #676, PENDING; re-triggered as #682)
 - [ ] 9. CLAIM M2 (await Adversary PASS)
 - [ ] 10. Write ## DONE (all Adversary PASSes)