test: add release upgrade compatibility matrix

[RentnerKev]

Summary

Add an automated, evidence-backed release compatibility matrix for upgrades to
v1.0.0-beta.1.

The matrix must use real published images/artifacts. Do not invent theoretical Alpha versions or
substitute a synthetic fixture for an end-to-end published-image upgrade.

Required matrix

Every selected pull request that changes migrations or persisted/runtime contracts

• fresh target install
• v1.0.0-alpha.6 -> beta.1 target

Scheduled and Beta release gate

• fresh beta.1 target install
• alpha.6 -> beta.1 (mandatory supported path)
• alpha.5 -> beta.1 and alpha.4 -> beta.1 (direct-support candidates)
• real-image evaluation of alpha.1, alpha.2, and alpha.3 to determine whether direct or
  staged support can be promised

Representative schema epochs may be used for ordinary PR feedback, but the release gate must not
claim support for an untested public source release.

Workflow strategy

• add a dedicated compatibility workflow with an explicit version matrix
• trigger it on selected pull requests that change migrations, encryption/persistence, runtime
  snapshots, backup/restore, or production packaging
• allow manual dispatch for diagnosis and release candidates
• run the broader historical matrix on a bounded schedule and as a Beta release gate
• keep normal PR feedback focused; do not download every historical image on unrelated changes
• identify the exact source image digest, target commit/image, and failed stage in diagnostics

Verify for each supported path

• application and database migration startup
• authentication, users, roles, and permissions
• Proxy Hosts, Redirect Hosts, Access Policies, trusted CAs, and certificates
• certificate candidates, ACME accounts, durable operation/retry state, DNS credentials, and
  host/certificate binding jobs where present in the source release
• application encryption key continuity
• trusted-proxy and canonical-origin settings/contracts
• desired runtime state and successful revision-confirmed reconciliation
• representative HTTP, HTTPS, WebSocket, and HTTP/3 behavior where applicable
• current Beta features and result state once feat: integrate CrowdSec protection #64, feat: add Forward Auth access policies #65, and feat: add Nginx Proxy Manager importer #66 are shipped
• backup-before-upgrade and rollback evidence coordinated with fix: harden backup and restore compatibility #71

Acceptance criteria

• Dedicated compatibility workflow and version matrix exist.
• alpha.6 -> beta.1 is a required Beta release gate.
• Historical entries use immutable real release images/artifacts.
• Selected PR, scheduled, manual, and release-gate triggers are documented and bounded.
• Failures identify source, target, migration/reconciliation stage, and useful redacted logs.
• The final supported/unsupported matrix matches fix: harden alpha-to-beta upgrade path #67 and public upgrade documentation.
• No production secrets are used.

Priority and sequencing

P0. Validates #67, coordinates restore coverage with #71, reuses the existing production smoke
foundation, and provides version-specific evidence required by #75.

[RentnerKev]

Implemented by merged PR #142. The dedicated matrix uses immutable published Alpha image digests. Fresh install and alpha.1 through alpha.6 direct upgrades passed on the final PR head (run 36330458099) and current main 8807839 (run 36700527838). The final release-commit rerun remains part of #75.