fix(prevb): prune orphan services on upgrade redeploy (head's dropped services); re-add EXPECTED_NA-other-rung test; consume Adversary inbox

docker stack deploy doesn't prune services the head compose dropped (discourse PR#4 drops sidekiq),
leaving them orphaned on the base image. perform_upgrade now reconciles the live stack to the head
compose service set (lifecycle.prune_orphan_services). Makes the deployed stack faithfully reflect
the head — no test weakened. No-op when service sets match / compose unresolvable.

runner/harness/generic.py

@@ -303,6 +303,11 @@ def perform_upgrade(
         http_timeout=int(meta.HTTP_TIMEOUT),
     )
     lifecycle.wait_ready_probes(meta, domain, timeout=int(meta.DEPLOY_TIMEOUT), op="upgrade")
+    # Reconcile the live stack to the head compose's service set: `docker stack deploy` doesn't prune
+    # services the head dropped (e.g. discourse PR#4 deletes sidekiq), leaving them orphaned on the
+    # base's old image. Remove them so the deployed stack faithfully reflects the head under test
+    # (phase prevb). No-op when service sets match / compose can't be resolved.
+    lifecycle.prune_orphan_services(domain, recipe)
     after = lifecycle.deployed_identity(domain)
     # Evidence (HC1): the chaos-version label = the deployed recipe commit; it should match the
     # PR-head we checked out — proving the upgrade deployed the code under test, not a published tag.