fix(prevb): prune orphan services on upgrade redeploy (head's dropped services); re-add EXPECTED_NA-other-rung test; consume Adversary inbox

docker stack deploy doesn't prune services the head compose dropped (discourse PR#4 drops sidekiq),
leaving them orphaned on the base image. perform_upgrade now reconciles the live stack to the head
compose service set (lifecycle.prune_orphan_services). Makes the deployed stack faithfully reflect
the head — no test weakened. No-op when service sets match / compose unresolvable.

tests/unit/test_upgrade_base.py

@@ -103,3 +103,13 @@ def test_no_canonical_no_main_skip(monkeypatch):
     _no_main(monkeypatch)
     plan = run_recipe_ci.resolve_upgrade_base(ALL, _meta(), "brandnew", head_ref=HEAD)
     assert plan.kind == "skip" and "no predecessor" in plan.reason
+
+
+def test_expected_na_other_rung_does_not_suppress_upgrade(monkeypatch):
+    # an EXPECTED_NA for a DIFFERENT rung (backup_restore) must NOT short-circuit the upgrade base —
+    # resolution proceeds to last-green/main-tip (custom-html-tiny shape).
+    _no_canonical(monkeypatch)
+    monkeypatch.setattr(lifecycle, "recipe_branch_commit", lambda r, b="main": MAIN)
+    meta = _meta(expected_na={"backup_restore": "stateless"})
+    plan = run_recipe_ci.resolve_upgrade_base(ALL, meta, "custom-html-tiny", head_ref=HEAD)
+    assert plan.kind == "ref" and plan.ref == MAIN