fix(2): normalize lightweight recipe tags to annotated before pinned deploy (R014)

lasuite-meet upgrade tier failed at the prev-version base deploy: abra's pinned-deploy lint FATA'd on
R014 'only annotated tags used for recipe version' because upstream coop-cloud lasuite-meet ships a
stray LIGHTWEIGHT tag (0.3.0+v1.16.0). chaos deploys skip lint (so install,custom passed) but the
upgrade tier's pinned prev-version deploy lints. New abra.normalize_recipe_tags() re-creates each
lightweight version tag as annotated at the SAME commit (no deployed content changes); called in
lifecycle.deploy_app after recipe_checkout when version is pinned. Idempotent; no-op for all-annotated
recipes (lasuite-drive etc.). Helps any recipe with a stray upstream lightweight tag.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

runner/harness/lifecycle.py

@@ -147,6 +147,10 @@ def deploy_app(
     # checkout). Order matters: checkout before secret_generate (-C) so secrets match the pinned tree.
     if version:
         abra.recipe_checkout(recipe, version)
+        # A pinned (non-chaos) deploy runs `abra recipe lint`; normalize any stray lightweight
+        # upstream tags to annotated so R014 doesn't FATA the whole recipe (changes no deployed
+        # content — see abra.normalize_recipe_tags). No-op for recipes with all-annotated tags.
+        abra.normalize_recipe_tags(recipe)
     # Pin DOMAIN to the run domain explicitly. `abra app new -D` fills it for recipes whose
     # .env.sample uses a literal placeholder, but NOT for ones using a `{{ .Domain }}` Go-template
     # (this abra version leaves it unexpanded → deploy fails "can't evaluate field Domain"). Setting