fix: abra app upgrade -o (offline) — was 401'ing fetching tags from the private mirror origin

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

runner/harness/abra.py

@@ -101,9 +101,10 @@ def upgrade(domain: str, version: Optional[str] = None, timeout: int = 900) -> N
     args = ["app", "upgrade", domain]
     if version:
         args.append(version)
-    # -f no prompt, -D skip public-DNS checks (our per-run domains route via the gateway).
-    # (upgrade has no --chaos flag.)
-    args += ["-f", "-D", "-n"]
+    # -f no prompt, -D skip public-DNS checks (our per-run domains route via the gateway), -o offline
+    # (use local tags — incl. the upstream tags fetched at clone — and DON'T fetch from the private
+    # mirror origin, which 401s). upgrade has no --chaos flag.
+    args += ["-f", "-D", "-n", "-o"]
     _run(args, timeout=timeout)