feat(canon): M1.2 release-tag trigger + faithful mirror-sync in the weekly sweep (§2.C/§2.D)

- warm_reconcile.sweep_decision(latest_tag, canon_version): pure new-release-tag trigger
  keyed on version_key (NOT commit) — new tag>canon → run; ==/older → skip no-new-version
  (even with untagged main commits); no tag → skip never-released. Unit-tested.
- scripts/recipe-mirror-sync.sh: faithful mirror sync (adapted from open-recipe-pr.sh
  --reconcile-only) — explicit coopcloud `upstream` remote (robust to inconsistent clone
  remotes), syncs main+TAGS, closes merged-upstream PRs, leaves unrelated PRs, bot-token auth.
- nightly_sweep rewritten: per enrolled recipe → mirror_sync → fetch → sweep_decision →
  run_on_tag (checkout the release tag + CCCI_SKIP_FETCH=1 so head IS the tag → tagged-promote
  gate passes, REF empty → promote allowed). Skips logged; run-twice → skip-all determinism.
- smoke-tested recipe-mirror-sync.sh live on custom-html: faithful no-op main/tags push,
  closed merged-upstream PR #2, left pending PR #5.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

runner/warm_reconcile.py

@@ -185,6 +185,29 @@ def latest_version(tags) -> str | None:
     return s[-1] if s else None
 
 
+def sweep_decision(latest_tag: str | None, canon_version: str | None) -> tuple[str, str]:
+    """Pure new-release-tag TRIGGER for the weekly sweep (phase canon §2.D), keyed on the latest
+    RELEASE TAG vs the recipe's canonical version — NOT on commits. Returns (action, reason) where
+    action is "run" or "skip":
+      - no release tag at all              → skip ("never-released")  — recipe never cut a release
+      - no canonical yet                   → run  (seed at latest_tag)
+      - latest_tag <= canonical (by key)   → skip ("no-new-version")  — even if `main` has NEW
+                                             UNTAGGED commits: the sweep tests releases, not commits
+      - latest_tag  > canonical (by key)   → run  (cold-test the new tagged version, then promote)
+    This is the run-twice determinism property: after a green run promotes canonical→latest_tag, a
+    second immediate sweep finds latest_tag == canonical for every recipe → skips all (clean no-op)."""
+    if not latest_tag:
+        return ("skip", "never-released (no release tag)")
+    if not canon_version:
+        return ("run", f"no canonical yet → seed at {latest_tag}")
+    if version_key(latest_tag) <= version_key(canon_version):
+        return (
+            "skip",
+            f"no-new-version (latest release {latest_tag} <= canonical {canon_version})",
+        )
+    return ("run", f"new release {latest_tag} > canonical {canon_version}")
+
+
 def is_released_version(recipe: str, version: str | None) -> bool:
     """True iff `version` corresponds to a PUBLISHED RELEASE TAG of the recipe (phase canon §2.A:
     the canonical may only ever advance to a real release — never an arbitrary untagged `main`