feat(mumble F2-14c): drop cc-ci compose.host-ports.yml fork; deploy 0.2.0 base minimally, add native host-ports on upgrade-to-latest via new UPGRADE_EXTRA_ENV harness hook + COMPOSE_FILE-aware READY_PROBE/install skip

runner/harness/abra.py

@@ -81,8 +81,8 @@ def recipe_checkout(recipe: str, version: str) -> None:
 
     path = os.path.expanduser(f"~/.abra/recipes/{recipe}")
     # -f (force): the version-pinning checkout must yield the EXACT ref tree. Without it, a cc-ci
-    # install_steps-provided overlay (e.g. mumble's compose.host-ports.yml, copied into a version that
-    # predates it) is an UNTRACKED file that collides with the same path TRACKED in a later ref, and
+    # install_steps-provided overlay (e.g. discourse's compose.ccci.yml, copied into the pinned base)
+    # is an UNTRACKED file that collides with the same path TRACKED in a later ref, and
     # `git checkout <ref>` aborts ("untracked working tree files would be overwritten"). Force resolves
     # it by writing the ref's tracked version. Safe: we never want local recipe-tree state preserved
     # across a version switch (and chaos deploys re-provide the overlay via install_steps when needed).
@@ -137,6 +137,25 @@ def env_set(domain: str, key: str, value: str) -> None:
         fh.write("\n".join(out) + "\n")
 
 
+def env_get(domain: str, key: str) -> str | None:
+    """Read a key from the app's .env (last uncommented assignment wins). None if absent. Symmetric
+    with env_set; abra has no getter. Strips surrounding quotes from the value."""
+    import os
+    import re
+
+    path = os.path.expanduser(f"~/.abra/servers/default/{domain}.env")
+    if not os.path.exists(path):
+        return None
+    pat = re.compile(rf"^\s*{re.escape(key)}=(.*)$")
+    val = None
+    with open(path) as fh:
+        for ln in fh.read().splitlines():
+            m = pat.match(ln)
+            if m:
+                val = m.group(1).strip().strip('"').strip("'")
+    return val
+
+
 def secret_generate(domain: str, timeout: int = 300) -> None:
     # -m avoids the TTY/table (ioctl) path; output (which contains the generated values) is
     # captured by _run and never logged. -C -o keep the recipe at the PR checkout (without -o it