feat(prevb): dynamic upgrade base (last-green→main→skip) + per-recipe previous/ overlay; migrate discourse off static base + leaky overlay

- resolve_upgrade_base: BasePlan(kind=version|ref|skip); last-green (warm canonical) primary,
  main-tip fallback, declared skip else. UPGRADE_BASE_VERSION retained as optional override.
- deploy_app: base_ref path (chaos-deploy a main-tip/last-green commit) + apply_previous wiring.
- lifecycle: previous/ surface (has_previous, previous_target_version, previous_status decision,
  provide/remove overlay, compose_file add/remove, recipe_branch_commit, stack_service_names).
- generic.perform_upgrade: strip previous/ overlay + COMPOSE_FILE entry before head redeploy.
- discourse: compose.ccci.yml now environmental-only (order: stop-first); removed bitnamilegacy
  pins + sidekiq + UPGRADE_BASE_VERSION; test_upgrade.py asserts head image == official 3.5.3 + no sidekiq.
- unit tests: resolve_upgrade_base matrix + previous/ apply/skip/stale + COMPOSE_FILE layering.

tests/discourse/recipe_meta.py

@@ -21,20 +21,18 @@ HTTP_TIMEOUT = 1200
 # still marks healthy immediately → fast hosts unaffected). Precedent: lasuite-drive collabora PR.
 # TIMEOUT (abra's internal convergence wait) is raised to outlast the boot.
 #
-# UPGRADE-tier BASE (compose.ccci.yml + UPGRADE_BASE_VERSION): upgrade-to-latest must ALWAYS run
-# (plan-ccci-compose-overlay-policy.md §1). The from-version is the latest published 0.7.0+3.3.1
-# (UPGRADE_BASE_VERSION below; the PR head is 0.7.0-based, so 0.7.0 is the true predecessor — not the
-# default [-2]=0.6.3). The published 0.7.0 has TWO blockers, both resolved by the policy-blessed
-# minimal base overlay compose.ccci.yml (see its header), neither weakening a test:
-#   (1) it pins the Docker-Hub-removed `bitnami/discourse:3.3.1` (404) → overlay re-pins app+sidekiq to
-#       `bitnamilegacy/discourse:3.3.1` (namespace-only, identical image), the same re-pin the PR makes;
-#   (2) its 5m start_period is too tight for the 15-25min Rails boot → overlay widens it to 20m (grace).
-# The harness auto-provides the overlay to the checkout and auto-chaoses the base deploy
-# (first-class compose.ccci.yml, rcust P2a); it persists across the head checkout (idempotent — the
-# PR head already re-pins + ships 20m).
-# Upgrade crossover: 0.7.0 (re-pinned base) → PR head; full assertions run on the HEAD. The 0.7.0
-# *custom* tests are not separately run (custom tier runs once, on the head — policy §1 allows skip+record).
-UPGRADE_BASE_VERSION = "0.7.0+3.3.1"
+# UPGRADE-tier BASE (phase prevb — DYNAMIC, no hardcoded UPGRADE_BASE_VERSION): the base the head
+# upgrades from is resolved at run time — last-green (warm canonical) → fallback target-branch (`main`)
+# tip → else skip (run_recipe_ci.resolve_upgrade_base). discourse has no warm canonical, so the base is
+# the `main` tip = bitnamilegacy/discourse:3.5.0, which deploys clean (bitnamilegacy exists) with NO
+# `previous/` repair needed. The PR head (recipe-maintainers/discourse#4) switches app to the official
+# `discourse/discourse:3.5.3` and drops the sidekiq service, so the upgrade tier now exercises the REAL
+# bitnamilegacy→official image migration the PR claims to support.
+#
+# compose.ccci.yml is now the ENVIRONMENTAL overlay (all deploys): only app.deploy.update_config.order:
+# stop-first (node memory reality on the upgrade crossover — see its header). The version-specific
+# bitnamilegacy re-pin + sidekiq block were REMOVED (they leaked onto the head and masked the migration
+# — the prevb bug). No assertion weakened: the head runs unmodified and full assertions run on it.
 EXTRA_ENV = {
     "TIMEOUT": "3600",  # abra's internal convergence wait; matches DEPLOY_TIMEOUT (slow Rails boot headroom)
     "COMPOSE_FILE": "compose.yml:compose.ccci.yml",