feat(canon): M1.2 release-tag trigger + faithful mirror-sync in the weekly sweep (§2.C/§2.D)

- warm_reconcile.sweep_decision(latest_tag, canon_version): pure new-release-tag trigger
  keyed on version_key (NOT commit) — new tag>canon → run; ==/older → skip no-new-version
  (even with untagged main commits); no tag → skip never-released. Unit-tested.
- scripts/recipe-mirror-sync.sh: faithful mirror sync (adapted from open-recipe-pr.sh
  --reconcile-only) — explicit coopcloud `upstream` remote (robust to inconsistent clone
  remotes), syncs main+TAGS, closes merged-upstream PRs, leaves unrelated PRs, bot-token auth.
- nightly_sweep rewritten: per enrolled recipe → mirror_sync → fetch → sweep_decision →
  run_on_tag (checkout the release tag + CCCI_SKIP_FETCH=1 so head IS the tag → tagged-promote
  gate passes, REF empty → promote allowed). Skips logged; run-twice → skip-all determinism.
- smoke-tested recipe-mirror-sync.sh live on custom-html: faithful no-op main/tags push,
  closed merged-upstream PR #2, left pending PR #5.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_warm_reconcile.py

@@ -45,6 +45,33 @@ def test_is_released_version(monkeypatch):
     assert wr.is_released_version("custom-html", "") is False
 
 
+def test_sweep_decision():
+    # canon §2.D new-release-tag trigger (pure), keyed on release tag vs canonical version.
+    # new release tag > canonical → run
+    assert wr.sweep_decision("1.13.0+1.31.1", "1.12.0+1.30.0")[0] == "run"
+    # latest tag == canonical → skip (no-new-version) — the run-twice determinism no-op
+    assert wr.sweep_decision("1.13.0+1.31.1", "1.13.0+1.31.1")[0] == "skip"
+    assert "no-new-version" in wr.sweep_decision("1.13.0+1.31.1", "1.13.0+1.31.1")[1]
+    # latest tag OLDER than canonical (shouldn't happen, but never downgrade) → skip
+    assert wr.sweep_decision("1.12.0+1.30.0", "1.13.0+1.31.1")[0] == "skip"
+    # no canonical yet → run (seed)
+    assert wr.sweep_decision("1.0.0+1.0.0", None)[0] == "run"
+    # no release tag at all → skip (never-released)
+    assert wr.sweep_decision(None, "1.0.0+1.0.0")[0] == "skip"
+    assert wr.sweep_decision(None, None)[0] == "skip"
+    assert "never-released" in wr.sweep_decision(None, None)[1]
+
+
+def test_sweep_decision_skips_untagged_ahead():
+    # The trigger compares the latest RELEASE TAG, not main HEAD: if main has new untagged commits
+    # but the latest tag still equals the canonical, the recipe is SKIPPED (no untagged promote).
+    # (Modelled here as latest_tag unchanged vs canonical — commits never enter the decision.)
+    assert wr.sweep_decision("2.0.0+9.9.9", "2.0.0+9.9.9") == (
+        "skip",
+        "no-new-version (latest release 2.0.0+9.9.9 <= canonical 2.0.0+9.9.9)",
+    )
+
+
 def test_is_released_version_no_tags(monkeypatch):
     # a recipe that has never cut a release → no version is a release
     monkeypatch.setattr(wr, "recipe_tags", lambda r: ["main"])