fix: upstream tag fetch needs explicit refspec (bare --tags errors 'no remote HEAD')

git fetch --tags <url> without a refspec errors 'couldn't find remote ref HEAD'; use
'refs/tags/*:refs/tags/*'. Verified: brings custom-html's 18 upstream version tags into the mirror
PR clone so the upgrade stage finds a previous published version (was skipping).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

runner/run_recipe_ci.py

@@ -96,7 +96,9 @@ def fetch_recipe(recipe: str, ref: str | None, src: str | None) -> None:
         # tags from the public upstream, never push to the recipe repo. Plain git (no bot token sent
         # to a foreign host). Non-fatal: if upstream is unreachable, upgrade degrades to a skip.
         upstream = f"https://git.coopcloud.tech/coop-cloud/{recipe}.git"
-        subprocess.run(["git", "-C", dest, "fetch", "--quiet", "--tags", upstream], check=False)
+        # Explicit tags refspec — a bare `fetch --tags <url>` errors "couldn't find remote ref HEAD".
+        subprocess.run(["git", "-C", dest, "fetch", "--quiet", upstream,
+                        "refs/tags/*:refs/tags/*"], check=False)
     else:
         # Clean re-fetch from the catalogue. rm first so a leftover dir from a prior SRC+REF run
         # (which points origin at the private mirror and may lack version tags) can't poison the