`coderai-docker --upgrade` was unusable: git.nexlab.net's certificate expired on
2026-09-15, the clone failed, and the script gave up — although the same
production branch sits on the public GitHub mirror. Nobody running the published
image has a stake in that host, so an unreachable default is now a detour, not a
dead end.

- packaging/linux/launcher/coderai-upgrade: clone_from() per remote; a connection
  /TLS/DNS failure on the DEFAULT remote retries the mirror and logs both the
  reason and the source it ended up using. A repo the operator named
  (--upgrade-repo / CODERAI_UPGRADE_REPO) or an SSH-key clone is never silently
  replaced, and a ref that does not exist stays an error — papering over that
  with the mirror would install the wrong code.
- Two bugs found while testing it, both silent:
  * `if ! cmd; then rc=$?` captured the status of the negation (0 on failure),
    so the fallback branch could never run;
  * reqs_content() ran under `set -o pipefail` with a `[[ -f ]] && grep` group,
    so a tree without packaging/common/requirements-oci.txt (or with no deps at
    all) aborted the upgrade one line after "upgrading x -> y", with no message.
- tests/test_upgrade_launcher.py: the real script against local git repos — no
  network — for the healthy default, the fallback, the explicit repo, a missing
  ref and an up-to-date install.

The certificate itself is on the host serving git.nexlab.net (94.23.108.54, not
lisa) and still needs renewing there.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B7EnDW6RSd2nhEPZMzMkqi