docs(prevb): update recipe-customization/testing/runbook for dynamic base + previous/ (drop stale recipe_versions[-2] model)

docs/runbook.md

@@ -32,9 +32,11 @@ curl -s -H "Authorization: Bearer $DT" --proxy socks5h://localhost:1055 \
   from the private mirror origin. All recipe-touching harness calls pass `-C -o` (chaos+offline);
   `recipe_versions`/upgrade use the upstream tags fetched read-only at clone time. If you see this,
   a new abra call is missing `-o`.
-- **upgrade stage SKIPPED ("no previous published version"):** the recipe clone has no version tags.
-  `fetch_recipe` read-only-fetches them from the public upstream (`git.coopcloud.tech/coop-cloud/<r>`);
-  confirm the upstream has ≥2 tags (`git ls-remote --tags`).
+- **upgrade stage SKIPPED:** the dynamic base resolved to `skip` (phase prevb) — no last-green warm
+  canonical AND no resolvable `main` tip, or `head == main tip` (no predecessor delta), or a declared
+  `EXPECTED_NA[upgrade]`. The run log prints the exact reason (`upgrade base: kind=skip … SKIP: <reason>`).
+  For a recipe that should upgrade from `main`, confirm the per-run clone has `origin/main` (or
+  `origin/master`) and that it differs from the PR head (`resolve_upgrade_base` in `run_recipe_ci.py`).
 - **health wait hangs / 502:** the app isn't answering `HEALTH_PATH` yet. Slow apps (keycloak JVM +
   Liquibase, lasuite 9-service) just need time; raise `DEPLOY_TIMEOUT`/`HTTP_TIMEOUT` in
   `recipe_meta.py`. A persistent 502 with services 1/1 = wrong `HEALTH_PATH` (e.g. keycloak needs