turns out opam 2 still needs two calls to properly upgrade

prepare-opam.sh

@@ -70,7 +70,7 @@ echo
 if [[ -z "$FRESH_OPAM" ]]; then # skip if this is a fresh opam root
     # Upgrade cached things
     echo_color "$BOLDGREEN" "[prepare-opam] Upgrading packages"
-    opam upgrade -y
+    opam upgrade -y --fixup && opam upgrade -y
     echo
 fi