recipe-maintainer: public snapshot (secrets + deployment plans removed, single commit)

Sanitized single-commit public mirror of recipe-maintainer.
- Removed test-ssh/.testenv (live creds); added test-ssh/.testenv.example placeholders.
- Removed plans/ and planned-updates/ (deployment-planning docs) so no client/
  deployment domains appear in the public repo.
- All other secret stores were already gitignored.
- docs.coopcloud.tech retained as a submodule (public upstream).

.claude/commands/recipe-upgrade-full.md

@@ -0,0 +1,69 @@
+---
+description: Plan and apply a recipe upgrade end-to-end, no human review in the middle
+argument-hint: <recipe-name>
+allowed-tools: [Bash, Read, Write, Edit, Glob, Grep, WebFetch, WebSearch]
+---
+
+# Recipe Upgrade Full
+
+Run the planning phase and the apply phase for a single recipe back-to-back, with no human-in-the-loop review between them. Designed for autonomous/cron use, and as the per-recipe worker spawned by `/recipe-upgrade-cron-all`.
+
+The recipe name is: $ARGUMENTS
+
+Read and follow the instructions in `.claude/commands/includes/logging.md`.
+Read and follow the instructions in `.claude/commands/includes/guidelines.md`.
+
+## Behaviour differences from running plan + apply manually
+
+- **No mid-skill confirmation.** Do not ask the user to review the plan before applying — proceed straight through.
+- **Uncommitted local changes ⇒ abort this recipe.** `recipe-upgrade-plan.md` step 2 normally asks the user to choose commit / stash / discard. In this skill, do NOT prompt: log the dirty state and exit with status `skipped: dirty-worktree`. The next cron run can pick the recipe up after a human cleans it.
+- **In-use lock for parallel safety.** Hold an `in-use/<recipe>.lock` file for the duration so any concurrent `context_reset.py` (e.g. from a sibling subagent) protects this recipe.
+- **Exit cleanly when up to date.** If `abra recipe upgrade <recipe> -m -n` reports no upgrades, remove the lock and exit with status `skipped: up-to-date`.
+
+## Steps
+
+### 1. Acquire the in-use lock
+
+```bash
+mkdir -p /workspace/in-use
+touch /workspace/in-use/$ARGUMENTS.lock
+```
+
+The lock MUST be released on every exit path below — success, failure, or early skip. The simplest way is to release it as the very last action in step 4, AND in every early-exit branch.
+
+### 2. Run the planning phase
+
+Follow **steps 1–9 of `.claude/commands/recipe-upgrade-plan.md`** verbatim, with these overrides:
+
+- **Step 2 override (dirty worktree):** if `git -C ~/.abra/recipes/$ARGUMENTS status --short` is non-empty, do NOT prompt. Instead:
+  - Log the dirty state (modified/staged/untracked files).
+  - Remove `/workspace/in-use/$ARGUMENTS.lock`.
+  - Emit final status `SKIPPED — uncommitted local changes in ~/.abra/recipes/$ARGUMENTS` and stop.
+- **Step 4 override (no upgrades):** if `abra recipe upgrade $ARGUMENTS -m -n` shows nothing to upgrade:
+  - Remove `/workspace/in-use/$ARGUMENTS.lock`.
+  - Emit final status `SKIPPED — already up to date` and stop.
+- **Step 10 (the "tell the user and stop" step) is omitted** — fall through to step 3 below instead.
+
+### 3. Run the apply phase
+
+Follow **all steps of `.claude/commands/recipe-upgrade-apply.md`** verbatim. Step 2 of the apply skill will find the plan file that step 9 of the plan phase just wrote.
+
+If any step in the apply phase fails (lint, deploy, tests, commit, PR):
+- Log the failure with enough detail to diagnose.
+- Skip the remaining apply steps (commit/tag/PR will already be guarded by the existing "only if all tests passed" conditions).
+- Continue to step 4 below — do NOT abort the lock release.
+
+### 4. Release the lock and report
+
+```bash
+rm -f /workspace/in-use/$ARGUMENTS.lock
+```
+
+Print a single-line final status that the calling skill (`/recipe-upgrade-cron-all`) can parse. Use one of these exact prefixes:
+
+- `RESULT: SUCCESS — <recipe> upgraded <old-version> → <new-version>, PR: <gitea-pr-url>`
+- `RESULT: SUCCESS-NO-PR — <recipe> upgraded but PR creation failed: <reason>`
+- `RESULT: FAILED — <recipe> at step <step-name>: <one-line-reason>`
+- `RESULT: SKIPPED — <recipe>: <up-to-date | dirty-worktree | other reason>`
+
+Follow with the normal human-readable summary (image tag changes, test results, etc.) that `recipe-upgrade-apply` step 13 produces.