fix(2): R014 normalize — use git clone --mirror (not --bare) so abra's later fetches find refs/heads/main

--bare lacked refs/heads/main, so abra's post-normalize git ops (app secret insert / deploy) failed
'unable to fetch tags: reference not found' when fetching from the repointed local origin. --mirror
copies all refs (heads+tags) → abra fetch OK + R014 passes (both verified).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

runner/harness/abra.py

@@ -134,7 +134,10 @@ def normalize_recipe_tags(recipe: str) -> int:
         # upstream lightweight tag) pulls the corrected tags instead.
         bare = os.path.expanduser(f"~/.abra/recipes/.{recipe}-ccci-fixed.git")
         subprocess.run(["rm", "-rf", bare], check=False)
-        subprocess.run(["git", "clone", "--quiet", "--bare", path, bare], check=True)
+        # --mirror (not --bare): copies ALL refs incl. refs/heads/main, so abra's later git ops
+        # (`app secret insert`, deploy) that fetch from origin find every ref ("reference not found"
+        # if main is missing). The annotated tags ride along.
+        subprocess.run(["git", "clone", "--quiet", "--mirror", path, bare], check=True)
         subprocess.run(
             ["git", "-C", path, "remote", "set-url", "origin", f"file://{bare}"], check=True
         )