fix(gtea): fix M2 blockers — LFS upgrade and REF=main HC1

Blocker 1 (LFS roundtrip fails on PR #1):
- Add UPGRADE_EXTRA_ENV to gitea recipe_meta.py — after PR-head checkout
  (compose.lfs.yml now in ABRA_DIR), add compose.lfs.yml to COMPOSE_FILE
  and set SECRET_LFS_JWT_SECRET_VERSION=v1 so the upgrade chaos redeploy
  actually runs with LFS enabled. Without this, the base install checks out
  the 3.5.x tag (compose.lfs.yml removed), EXTRA_ENV sees no LFS, and the
  upgrade chaos redeploy inherits the no-LFS .env — so the LFS test runs
  (compose.lfs.yml is restored by recipe_checkout_ref) but LFS is off.
- Add abra.secret_generate(domain) in generic.perform_upgrade when
  upgrade_env is non-empty — generates lfs_jwt_secret before chaos redeploy.

Blocker 2 (REF=main upgrade fails HC1):
- Always use recipe_head_commit (git rev-parse HEAD) for head_ref instead
  of using ref directly. When ref="main" (a branch name), the HC1 commit
  check "head_ref.startswith(chaos_commit)" always fails since "main" ≠ SHA.
  recipe_head_commit returns the actual SHA after the fetch/checkout.

Side-fix (stale creds — build #675):
- ops.py pre_install: delete the per-domain creds file before calling
  _ensure_admin. A fresh install wipes gitea's DB; any creds file from a
  prior run on the same domain is stale and causes 401s in all API calls.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

runner/harness/generic.py

@@ -260,6 +260,11 @@ def perform_upgrade(
     for k, v in upgrade_env.items():
         print(f"  upgrade-env: {k}={v}", flush=True)
         abra.env_set(domain, k, v)
+    if upgrade_env:
+        # UPGRADE_EXTRA_ENV may introduce new SECRET_* vars (e.g. lfs_jwt_secret for the LFS overlay
+        # landing in a PR). Generate any missing secrets now — abra secret generate is idempotent
+        # (skips secrets that already exist) — before the chaos redeploy references them.
+        abra.secret_generate(domain)
     # HQ1: warm the NEW-version image set before the chaos redeploy (the head_ref checkout's pinned
     # tags) so a pull failure is a clear pre-deploy error and convergence isn't pull-bound.
     lifecycle.prepull_images(recipe, domain)

runner/run_recipe_ci.py

@@ -926,9 +926,10 @@ def main() -> int:
     setup_run_abra_dir()
     fetch_recipe(recipe, ref, src)
     # The PR-head commit the upgrade tier re-checks out for the chaos redeploy to the code under test
-    # (HC1). Prefer the explicit PR head sha ($REF) — robust + exact; fall back to the recipe checkout
-    # HEAD (the catalogue current) for a non-PR `!testme`. Captured before any version-tag checkout.
-    head_ref = ref or lifecycle.recipe_head_commit(recipe)
+    # (HC1). Always resolve to the actual git SHA — `ref` may be a branch name ("main") which fails
+    # the HC1 commit-identity check (chaos-version is always a SHA). recipe_head_commit runs
+    # git-rev-parse HEAD, which returns the SHA of wherever the fetch/checkout landed.
+    head_ref = lifecycle.recipe_head_commit(recipe)
     repo_local = snapshot_recipe_tests(recipe)
     meta = meta_mod.load(recipe)