fix(1e): HC1 upgrade/restore tier calls now pass head_ref (multi-line edit miss)

Earlier perl substitution missed the multi-line upgrade and restore run_lifecycle_tier calls (still
passed `target` = VERSION env, None for !testme runs), so perform_upgrade got head_ref=None for
upgrade tier → re-checkout skipped → chaos redeploy of leftover prev checkout (vacuous prev→prev that
'passed' via the chaos-label move fallback).

Verified e2e on hedgedoc (install,upgrade; commit pending push):
  upgrade→PR-head: head_ref=09bf4d54 chaos-version=09bf4d54 version=3.0.9+1.10.7→3.0.10+1.10.8
deploy-count=1, install/upgrade=pass, clean teardown. The chaos-version label deterministically
matches head_ref — direct proof PR-head code was deployed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

machine-docs/STATUS-1e.md

@@ -18,8 +18,11 @@ Three corrections, each Adversary cold-verified, no test weakened:
 
 ## Definition of Done (Phase 1e) — HC1–HC4, each Adversary cold-verified in REVIEW-1e
 - [ ] **HC1** — PR-head upgrade proven to deploy PR-head; deploy-count guard reconciled (==1).
-- [ ] **HC2** — repo-local ignored for a non-approved recipe, run for an approved one.
-- [ ] **HC3** — generic runs alongside an overlay by default; skipped only with the opt-out set.
+- [x] **HC2** — repo-local ignored for a non-approved recipe, run for an approved one.
+      Adversary PASS @2026-05-28 (hostile-code probe, no finding; commit c7ae296).
+- [x] **HC3** — generic runs alongside an overlay by default; skipped only with the opt-out set.
+      Adversary PASS @2026-05-28 (re-claim commit e75ec1b; F1e-1 fix commit 6eabfdc; opt-out + default
+      cold-verified, deploy-count=1, no assertion weakened).
 - [ ] **HC4** — no regression cold-verified; deploy-once + teardown still sacred.
 
 ## Milestones (plan §3)