fix(canon): promote does a FAITHFUL warm install (clean tree + deps + install_steps)

M2 finding (Adversary-flagged): promote_canonical did a bare `abra app deploy` that lacked the
cold install's wiring, so recipes that passed the cold test still failed to promote:
- ghost: `abra app new` FATA 'locally unstaged changes' — the CCCI_SKIP_FETCH per-run tree was
  left dirty by the tier suite. Fix: force re-checkout the tag + `git clean -fd` before deploy.
- bluesky-pds: missing pds_plc_rotation_key (install_steps inserts it, #generate=false).
- custom-html-tiny: 404 (install_steps seeds index.html). Fix: run install_steps_hook in promote.
- OIDC recipes would miss their realm. Fix: provision DEPS in promote like the cold install.
promote_canonical now: clean tree → provision deps → deploy_app with install_steps_hook + overlay +
ready-probes, then snapshot. Also: sweep result label now derives from whether the canonical was
actually written (promote is non-fatal; rc==0 did not imply promoted) — fixes the misleading
'PASS (promoted)'.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

runner/nightly_sweep.py

@@ -116,7 +116,17 @@ def sweep() -> int:
             continue
         print(f"sweep: {r} RUN — {reason}; cold-testing tagged release {latest}", flush=True)
         rc = run_on_tag(r, latest)
-        results[r] = "PASS (promoted)" if rc == 0 else "FAIL (canonical unchanged)"
+        # Trustworthy label (canon M2): promote_canonical is non-fatal, so rc==0 does NOT imply a
+        # canonical was written. Derive the result from whether the registry now records `latest`.
+        rec = canonical.read_registry(r) or {}
+        if rc != 0:
+            results[r] = "FAIL (red; canonical unchanged)"
+        elif rec.get("version") == latest:
+            results[r] = f"PASS (promoted {latest})"
+        else:
+            results[r] = (
+                f"GREEN-BUT-PROMOTE-FAILED (canonical={rec.get('version') or 'none'}, expected {latest})"
+            )
         print(f"sweep: {r} rc={rc} ({results[r]})", flush=True)
     # WC8 disk hygiene: drop warm data for de-enrolled canonicals; log the disk budget.
     pruned = canonical.prune_stale()