fix(gtea): fix M2 blockers — LFS upgrade and REF=main HC1

Blocker 1 (LFS roundtrip fails on PR #1):
- Add UPGRADE_EXTRA_ENV to gitea recipe_meta.py — after PR-head checkout
  (compose.lfs.yml now in ABRA_DIR), add compose.lfs.yml to COMPOSE_FILE
  and set SECRET_LFS_JWT_SECRET_VERSION=v1 so the upgrade chaos redeploy
  actually runs with LFS enabled. Without this, the base install checks out
  the 3.5.x tag (compose.lfs.yml removed), EXTRA_ENV sees no LFS, and the
  upgrade chaos redeploy inherits the no-LFS .env — so the LFS test runs
  (compose.lfs.yml is restored by recipe_checkout_ref) but LFS is off.
- Add abra.secret_generate(domain) in generic.perform_upgrade when
  upgrade_env is non-empty — generates lfs_jwt_secret before chaos redeploy.

Blocker 2 (REF=main upgrade fails HC1):
- Always use recipe_head_commit (git rev-parse HEAD) for head_ref instead
  of using ref directly. When ref="main" (a branch name), the HC1 commit
  check "head_ref.startswith(chaos_commit)" always fails since "main" ≠ SHA.
  recipe_head_commit returns the actual SHA after the fetch/checkout.

Side-fix (stale creds — build #675):
- ops.py pre_install: delete the per-domain creds file before calling
  _ensure_admin. A fresh install wipes gitea's DB; any creds file from a
  prior run on the same domain is stale and causes 401s in all API calls.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/gitea/ops.py

@@ -172,6 +172,11 @@ def pre_install(ctx):
     # Wait explicitly so the API is fully ready (READY_PROBE guards this at the harness level, but
     # belt-and-suspenders here in case this op is called in isolation).
     generic.assert_serving(ctx.domain, ctx.meta)
+    # Fresh install wiped the DB. Any creds file from a previous run on this domain is stale
+    # (user no longer exists in the new DB). Remove it so _ensure_admin creates a fresh user.
+    stale = _creds_path(ctx.domain)
+    if os.path.exists(stale):
+        os.remove(stale)
     user, password = _ensure_admin(ctx.domain)
     ok = _create_marker_repo(ctx.domain, user, password)
     assert ok, f"pre_install: could not create {_MARKER_REPO} repo on {ctx.domain}"