feat(prevb): dynamic upgrade base (last-green→main→skip) + per-recipe previous/ overlay; migrate discourse off static base + leaky overlay

- resolve_upgrade_base: BasePlan(kind=version|ref|skip); last-green (warm canonical) primary,
  main-tip fallback, declared skip else. UPGRADE_BASE_VERSION retained as optional override.
- deploy_app: base_ref path (chaos-deploy a main-tip/last-green commit) + apply_previous wiring.
- lifecycle: previous/ surface (has_previous, previous_target_version, previous_status decision,
  provide/remove overlay, compose_file add/remove, recipe_branch_commit, stack_service_names).
- generic.perform_upgrade: strip previous/ overlay + COMPOSE_FILE entry before head redeploy.
- discourse: compose.ccci.yml now environmental-only (order: stop-first); removed bitnamilegacy
  pins + sidekiq + UPGRADE_BASE_VERSION; test_upgrade.py asserts head image == official 3.5.3 + no sidekiq.
- unit tests: resolve_upgrade_base matrix + previous/ apply/skip/stale + COMPOSE_FILE layering.

tests/discourse/test_upgrade.py

@@ -0,0 +1,40 @@
+"""discourse — UPGRADE overlay (phase prevb): FAITHFULNESS assertion that the PR head genuinely ran.
+
+The whole point of phase prevb: the old all-deploys overlay re-pinned the head back to
+bitnamilegacy/discourse:3.3.1 and re-added the sidekiq service, so the head's official-image
+migration was never tested. With the version-specific config removed from the all-deploys overlay
+and the dynamic base (last-green/main = bitnamilegacy:3.5.0) deployed only as the *base*, the upgrade
+chaos redeploy must land the PR head UNMODIFIED. This overlay asserts exactly that, post-upgrade:
+
+  1. the running `app` service image IS the official discourse/discourse:3.5.3 — NOT bitnamilegacy;
+  2. the `sidekiq` service the PR deletes is GONE from the deployed stack.
+
+If either fails, the head did not really run (the overlay leaked onto it) → RED. Assertion-only,
+additive to the generic upgrade tier (which already proves reconverge/serving/moved + HC1 commit stamp).
+"""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+from harness import lifecycle  # noqa: E402
+
+
+def test_head_runs_official_image_not_bitnamilegacy(live_app):
+    image = lifecycle.deployed_identity(live_app, service="app").get("image") or ""
+    assert "bitnamilegacy" not in image, (
+        f"app image is {image!r} — the bitnamilegacy base leaked onto the PR head "
+        "(the version-specific overlay was applied to the head, the prevb bug)"
+    )
+    assert image.startswith("discourse/discourse:3.5.3"), (
+        f"app image is {image!r}, expected the PR head's official discourse/discourse:3.5.3 "
+        "— the head's image migration was not exercised"
+    )
+
+
+def test_sidekiq_service_dropped_by_head(live_app):
+    services = lifecycle.stack_service_names(live_app)
+    assert "sidekiq" not in services, (
+        f"sidekiq service still present after the upgrade to the PR head: {services} — the head "
+        "(which deletes sidekiq) did not really deploy"
+    )