feat(distribution): make upgrades previewable and rollback-safe

[teckedd-code2save]

Goal

Close the upgrade/recovery gap in #93 so an authorized agent can upgrade a GroundControl instance without turning migrations into a one-way door.

Canonical installer additions

scripts/install now supports:

• --preview
• guarded --upgrade
• data-preserving --uninstall

Upgrade preview

--preview --version <tag> checks:

• current container state
• persistent /app/prisma storage identity
• target image reachability
• available disk
• requested target

It does not change the running GroundControl instance.

Guarded upgrade transaction

For an existing instance:

1. pull the requested image while the old instance is still running
2. resolve the pulled image to its registry digest when available
3. refuse upgrade if persistent DB storage cannot be identified
4. stop GC briefly for a consistent SQLite backup
5. save DB + Compose + env state
6. start the digest-pinned image
7. treat container health after migrations as the acceptance gate
8. on failure, restore DB + previous image/config
9. verify rollback health
10. retain structured evidence + failed-upgrade logs

Machine outcomes:

• upgrade_complete
• upgrade_rolled_back
• rollback_failed

A successful automatic rollback exits non-zero because the requested upgrade still failed.

Uninstall

--uninstall removes the runtime and local bridge containers but preserves:

• DB volume
• install directory
• secrets/config backup

No destructive purge is implicit.

Integrity

Adds scripts/install.sha256.

Both CI workflows now run:

• bash -n scripts/install
• sha256sum -c scripts/install.sha256

Docs include the safer download → checksum → run flow.

Regression coverage

A Vitest contract locks:

• preview/upgrade/uninstall flags
• digest resolution
• DB backup requirement
• rollback states
• failed-upgrade evidence
• data-preserving uninstall
• loopback-only management port

This builds on #97's already-live install → claim → publish/bridge → post-install verification flow.