feat(prevb): dynamic upgrade base (last-green→main→skip) + per-recipe previous/ overlay; migrate discourse off static base + leaky overlay

- resolve_upgrade_base: BasePlan(kind=version|ref|skip); last-green (warm canonical) primary,
  main-tip fallback, declared skip else. UPGRADE_BASE_VERSION retained as optional override.
- deploy_app: base_ref path (chaos-deploy a main-tip/last-green commit) + apply_previous wiring.
- lifecycle: previous/ surface (has_previous, previous_target_version, previous_status decision,
  provide/remove overlay, compose_file add/remove, recipe_branch_commit, stack_service_names).
- generic.perform_upgrade: strip previous/ overlay + COMPOSE_FILE entry before head redeploy.
- discourse: compose.ccci.yml now environmental-only (order: stop-first); removed bitnamilegacy
  pins + sidekiq + UPGRADE_BASE_VERSION; test_upgrade.py asserts head image == official 3.5.3 + no sidekiq.
- unit tests: resolve_upgrade_base matrix + previous/ apply/skip/stale + COMPOSE_FILE layering.

runner/harness/generic.py

@@ -251,6 +251,16 @@ def perform_upgrade(
     before = lifecycle.deployed_identity(domain)
     if head_ref:
         lifecycle.recipe_checkout_ref(recipe, head_ref)
+    # Phase prevb: strip the base-only `previous/` overlay before the head redeploy so the PR head
+    # runs UNMODIFIED (the version-specific repair must never leak onto the head). Delete the copied
+    # compose.previous.yml and drop it from COMPOSE_FILE in the app .env. No-op when no previous/ was
+    # applied (the file/entry are absent). The environmental compose.ccci.yml stays (all deploys).
+    lifecycle.remove_previous_overlay(recipe)
+    cf_now = abra.env_get(domain, "COMPOSE_FILE")
+    if cf_now and lifecycle.PREVIOUS_COMPOSE in cf_now:
+        cf_stripped = lifecycle.compose_file_remove(cf_now, lifecycle.PREVIOUS_COMPOSE)
+        abra.env_set(domain, "COMPOSE_FILE", cf_stripped)
+        print(f"  previous-overlay: COMPOSE_FILE for head redeploy = {cf_stripped}", flush=True)
     # UPGRADE_EXTRA_ENV (F2-14c): a recipe may need different app .env for the upgrade-TARGET deploy
     # than for the base — e.g. mumble's `compose.host-ports.yml` overlay exists ONLY in the newer
     # (target) version, so the base deploys minimally WITHOUT it and the upgrade adds it to COMPOSE_FILE