feat(canon): §2.G strip UPGRADE_BASE_VERSION entirely (plausible verified dynamic-base green)

Gate satisfied — live: with the pin removed, plausible's upgrade tier resolves base 3.0.1+v2.0.0 via
the same-version step-back (canonical 3.1.0 == head 3.1.0 → newest-older = 3.0.1, NOT the broken
3.0.0) and passes install+upgrade green (level 5/5). The pin is redundant, so removed everywhere:
- meta.py KEYS entry (RecipeMeta field auto-drops; 15→14 keys).
- run_recipe_ci.resolve_upgrade_base override branch + docstrings.
- tests/unit/test_meta.py (count 15→14, dropped None-assert), test_upgrade_base.py (override test).
- docs/recipe-customization.md (regenerated table + mentions), docs/testing.md.
- tests/plausible/recipe_meta.py (pin removed), tests/bluesky-pds (re-enable note → dynamic base).
294 unit tests pass; lint clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/recipe-customization.md

@@ -20,7 +20,7 @@ A recipe customizes its CI through **three distinct mechanisms**:
 
 | Surface | Form | Examples |
 |---|---|---|
-| **Declarative settings** | Python assignments in `tests/<recipe>/recipe_meta.py` | `DEPLOY_TIMEOUT = 1500`, `UPGRADE_BASE_VERSION = "2.3.1+..."` |
+| **Declarative settings** | Python assignments in `tests/<recipe>/recipe_meta.py` | `DEPLOY_TIMEOUT = 1500`, `HEALTH_PATH = "/api/health"` |
 | **Code hooks** | Callables in `recipe_meta.py`, `ops.py` functions, one shell hook | `def READY_PROBE(ctx): ...`, `pre_upgrade(ctx)`, `install_steps.sh` |
 | **File presence** | A file existing at a discovered path changes behavior | `test_upgrade.py` overlay, `custom/test_*.py`, `compose.ccci.yml` |
 
@@ -122,7 +122,6 @@ _This table is GENERATED from the `runner/harness/meta.py` KEYS registry by `scr
 | `BACKUP_CAPABLE` | `bool` | `None` | Override the backup-tier capability auto-detect (compose `backupbot.backup` labels). `False` forces an intentional skip of the backup/restore rung; `True` forces the tier on; unset = auto-detect. |
 | `EXPECTED_NA` | `dict` | `None` | Declare a non-run rung an INTENTIONAL skip: `{rung: reason}` — the level climbs past it; an undeclared non-run rung is *unverified* and blocks the level above it (classification table: machine-docs/DECISIONS.md phase lvl5). Never overrides an exercised pass/fail; the `lint` rung has no escape hatch. Declaring `upgrade` also suppresses the upgrade-tier BASE deploy — the single deploy is the PR head itself — for recipes whose published versions exist but are genuinely undeployable (phase bsky). |
 | `READY_PROBE` | `hook` | `None` | Callable `(ctx) -> [probe, ...]` returning extra readiness probes, run after install AND after upgrade: HTTP `{host, path, ok}` or TCP `{tcp_host, tcp_port, stable}`. |
-| `UPGRADE_BASE_VERSION` | `str` | `None` | Optional explicit override pinning the upgrade tier's base to an exact published tag (rare; for a PR that adds a version *above* the newest tag). When unset (the norm) the base is resolved DYNAMICALLY (phase prevb): last-green (warm canonical) → target-branch (`main`) tip → else skip. See `run_recipe_ci.resolve_upgrade_base` + DECISIONS. |
 | `BACKUP_VERIFY` | `hook` | `None` | Callable `(ctx) -> bool` post-backup data-capture check; `False` re-runs the backup (truncated-dump race guard), retried up to 3 attempts. |
 | `UPGRADE_EXTRA_ENV` | `dict_or_hook` | `None` | Extra `.env` keys applied after the PR-head checkout, before the chaos redeploy (env that exists only at head). Dict, or callable `(ctx) -> dict`. |
 | `EXTRA_ENV` | `dict_or_hook` | `{}` | Extra `.env` keys applied at EVERY deploy (base install AND upgrade old-app). Dict, or callable `(ctx) -> dict` deriving values from the per-run domain (`ctx.domain`). |
@@ -292,7 +291,7 @@ One deploy chain per run (full detail: `docs/testing.md` §2):
 
 ```
 [DEPS? provision deps FIRST → $CCCI_DEPS_FILE]
-deploy BASE (dynamic: last-green → main-tip → skip, or UPGRADE_BASE_VERSION override; EXTRA_ENV;
+deploy BASE (dynamic: last-green → same-version step-back → main-tip → skip; EXTRA_ENV;
              install_steps.sh; compose.ccci.yml [environmental] auto-copied + auto-chaos;
              tests/<recipe>/previous/ [version-specific, base-ONLY] applied if it matches the base)
   → INSTALL tier   (READY_PROBE; generic + overlay asserts)

docs/testing.md

@@ -206,7 +206,8 @@ Concretely, the upgrade tier:
    canonical, pinned-tag deploy) → else the target-branch `main` tip (chaos deploy of the branch
    HEAD — the real predecessor the PR merges onto) → else the upgrade tier is skipped. An optional
    `tests/<recipe>/previous/` supplies version-specific repair to the base ONLY (stripped before the
-   head redeploy). `UPGRADE_BASE_VERSION` may still pin an explicit tag override.
+   head redeploy). (The old explicit `UPGRADE_BASE_VERSION` pin was removed in phase canon §2.G — the
+   dynamic last-green/step-back resolution makes it redundant.)
 2. orchestrator captures `head_ref` (preferring `$REF` — the PR head sha; falls back to the recipe
    checkout HEAD for non-PR `!testme`).
 3. on the upgrade tier: re-checkout the recipe to `head_ref` (the prev-tag base deploy reset the