f94de22234
All checks were successful
continuous-integration/drone/push Build is passing
M2 finding (Adversary-flagged): promote_canonical did a bare `abra app deploy` that lacked the cold install's wiring, so recipes that passed the cold test still failed to promote: - ghost: `abra app new` FATA 'locally unstaged changes' — the CCCI_SKIP_FETCH per-run tree was left dirty by the tier suite. Fix: force re-checkout the tag + `git clean -fd` before deploy. - bluesky-pds: missing pds_plc_rotation_key (install_steps inserts it, #generate=false). - custom-html-tiny: 404 (install_steps seeds index.html). Fix: run install_steps_hook in promote. - OIDC recipes would miss their realm. Fix: provision DEPS in promote like the cold install. promote_canonical now: clean tree → provision deps → deploy_app with install_steps_hook + overlay + ready-probes, then snapshot. Also: sweep result label now derives from whether the canonical was actually written (promote is non-fatal; rc==0 did not imply promoted) — fixes the misleading 'PASS (promoted)'. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>