claim(2): HQ1 image pre-pull — warm local store before deploy (4 unit tests + warm-cache-skip + bad-tag-clear-error + abra-unchanged)

lifecycle.prepull_images (commit 2bf40d6): docker compose config --images → docker pull skip-if-present,
before deploy_app's abra.deploy + perform_upgrade's chaos redeploy. Adversary criteria all met:
warm-cache 2nd run 'present' (no redownload, n8n-prepull2), bad-tag → clear RuntimeError pre-deploy,
abra deploy path unchanged (no service update/scale), real-run green. 4 unit tests pass. Gate evidence
in STATUS-2.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

machine-docs/BACKLOG-2.md

@@ -184,7 +184,14 @@ Phase plan: `/srv/cc-ci/cc-ci-plan/plan-phase2-recipe-tests.md`
       with the F2-7 keycloak-specificity caveat; worked lasuite-docs example end-to-end. **Will
       re-pass when Q3.2/Q3.5 enroll new recipes** (immich/lasuite-drive) to confirm a new
       engineer can follow the doc cold.
-- [ ] **HQ1 — Harness image pre-pull (near-term unit, orchestrator 2026-05-29).** PLAN:
+- [x] **HQ1 — Harness image pre-pull — DONE @2026-05-29 (commit `2bf40d6`), CLAIMED (STATUS-2 gate),
+      awaiting Adversary.** `lifecycle.prepull_images` resolves images via `docker compose config
+      --images` (COMPOSE_FILE from app .env; $VERSION interpolation + multi-compose) → `docker pull`
+      skip-if-present; called in deploy_app before the (unchanged real) abra.deploy AND in
+      perform_upgrade before the chaos redeploy. Validated: 4 unit tests (tests/unit/test_prepull.py)
+      + warm-cache 2nd run "present" (no re-download) + bad-tag → clear RuntimeError pre-deploy +
+      abra deploy unchanged (no service update/scale). Original spec below.
+- [ ] **HQ1 (orig)** — Harness image pre-pull (near-term unit, orchestrator 2026-05-29). PLAN:
       `cc-ci-plan/plan-prepull-images.md`. At the START of a recipe test sequence (before the first
       `abra app deploy`) AND before the upgrade tier's new-version deploy: resolve recipe images via
       `docker compose --env-file <app.env> -f <COMPOSE_FILE> config --images` and `docker pull` each