Prove prior-version managed CLI upgrade convergence

[TheGreenCedar]

Context

The six native managed-lifecycle cells proved fresh installation, but #921 still lacked an upgrade path starting from a verified prior managed CLI. Retention had unit coverage in isolation; it was not joined to exact-version publication, managed MCP activation, grounding convergence, durable repair identity, and rollback evidence.

Closes #1036
Refs #921
Refs #887
Refs #1037

What Changed

• Seed every native managed-convergence cell with a checksummed prior managed CLI whose executable answers only its fixed --version; selecting it for MCP exits 90 and fails the gate.
• Require the requested packaged archive to publish and serve MCP with exact executable provenance, then activate through ground on a deliberately stale local publication.
• Observe the automatic repair through bounded MCP status polls and require exactly one durable attempt with one matching project/profile/run/namespace identity through terminal completion.
• Require a newer complete local generation while packet/search remain fail-closed without verified accelerator smoke.
• Require the requested version as active and the verified prior version only as rollback, recording managed-plugin-upgrade.json in every native cell.
• Upgrade the real launcher static test from fresh provisioning to prior-version convergence.

How To Review

1. Review plugin_stdio_handoff in .github/scripts/check-packaged-agent-proof.py: the prior fixture must pass installed-version verification but cannot serve MCP.
2. Review require_managed_plugin_convergence: observational status must not mutate ownership; ground is the activation boundary; all durable attempt records must share one attempt and one project/profile/run/namespace identity.
3. Confirm retention requires the packaged version as active and the prior version as rollback.
4. Review the real-launcher regression in plugins/codestory/tests/plugin-static.test.mjs for cross-platform fixture behavior.

Verification

• python .github/scripts/check-packaged-agent-proof.py --self-test — passed
• node --test --test-name-pattern='upgrades a verified prior managed cli' plugins/codestory/tests/plugin-static.test.mjs — 1 passed
• node --test plugins/codestory/tests/plugin-static.test.mjs — 72 passed
• node .github/scripts/check-workflow-policy.mjs — passed
• node .github/scripts/check-doc-links.mjs — 69 files, 281 relative links
• python -m py_compile .github/scripts/check-packaged-agent-proof.py — passed
• git diff --check — passed
• exact-head packaged and plugin workflow dispatches are running at 1f9e49b8d47e18b9bf7d984ce64984b8f3cd4825

No local Cargo command was needed because the diff is Python proof code, Node launcher tests, and documentation.

Risk

The proof adds a prior fixture and bounded convergence polling to every native matrix cell, increasing matrix time slightly. The synthetic prior executable deliberately cannot serve MCP, so false selection fails closed. Native CI remains the final cross-platform execution proof. This PR does not close #921 or #887 and makes no glibc claim.