fix(canon): release cold-run app/dep locks before promote (cold-dep self-deadlock)

drone (DEPS=[gitea], a COLD dep) deadlocked in promote: the cold test holds the gitea dep's
app-lock for the whole process lifetime, and promote's _provision_deps re-acquires the same lock
in the same process → blocks forever. By promote time the cold test + its deps are torn down
(dep teardown runs in the run finally, before promote), so the locks are stale. New
lifecycle.release_app_locks() frees them at promote start; the serial sweep guarantees no
concurrent run relies on them. lasuite-* (warm keycloak dep) were unaffected (no cold deploy).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

runner/run_recipe_ci.py

@@ -962,6 +962,10 @@ def promote_canonical(
         flush=True,
     )
     # Faithful install wiring: deps (OIDC) then install_steps (via deploy_app's hook), same as cold.
+    # Release the cold run's process-lifetime app/dep locks first: the cold test + its deps are torn
+    # down by now, but their locks are still held by THIS process, so re-provisioning a COLD dep
+    # (e.g. drone→gitea) would self-deadlock on acquire_app_lock. Serial sweep → safe to release.
+    lifecycle.release_app_locks()
     declared = list(meta.DEPS)
     if declared:
         try: