fix(1d): F1d-2 — pinned base deploys the pinned version; upgrade is non-vacuous

- deploy_app: checkout the pinned tag + deploy NON-chaos when a version is pinned (chaos only for
  version=None / PR-head). Was always -C, which ignored the pin and deployed LATEST -> upgrade no-op.
- do_upgrade: assert the deployment actually MOVED (coop-cloud version label and/or image changed)
  via lifecycle.deployed_identity -> a vacuous no-op upgrade can no longer pass (DG2).
- G2: migrate custom-html overlays to the assertion-only contract (override + extend-by-composition
  + data-continuity; split backup/restore). tests/unit/test_discovery.py proves precedence (5/5).

Probe (Adversary's F1d-2 test): hedgedoc deploy-prev=1.10.7 -> upgrade=1.10.8, CHANGED=True.
hedgedoc full generic lifecycle green (install/upgrade/backup/restore, deploy-count=1).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

runner/harness/generic.py

@@ -120,9 +120,21 @@ def assert_serving(domain: str, meta: dict) -> None:
 
 def do_upgrade(domain: str, target: str | None, meta: dict) -> None:
     """UPGRADE op (in place on the shared deployment): abra app upgrade -> target, then assert it
-    reconverges + still serves (assert_serving polls, so the rolling upgrade settles)."""
+    reconverges + still serves AND that the deployment actually MOVED (version label and/or image
+    changed). The move assertion guards against a vacuous no-op upgrade silently passing — the exact
+    F1d-2 failure where a mis-pinned base deployed LATEST so 'upgrade to latest' changed nothing."""
+    before = lifecycle.deployed_identity(domain)
     lifecycle.upgrade_app(domain, version=target)
     assert_serving(domain, meta)
+    after = lifecycle.deployed_identity(domain)
+    moved = (before[0] and after[0] and before[0] != after[0]) or (
+        before[1] and after[1] and before[1] != after[1]
+    )
+    assert moved, (
+        f"{domain}: upgrade did not move the deployment "
+        f"(version {before[0]}->{after[0]}, image {before[1]}->{after[1]}) — "
+        "not a real previous->target upgrade (DG2 must be non-vacuous)"
+    )
 
 
 _SNAPSHOT_ID_RE = re.compile(r'"snapshot_id"\s*:\s*"([0-9a-f]{8,})"')