Add runtime host upgrade compatibility preflight

[Staphylococcus]

Parent: #91

Outcome

Determine from observed runtime and installation state whether the release-bundle updater can safely act on the current host. Ship a conservative initial compatibility boundary that can be refined as real installations expose additional checks.

Scope

• Define structured host-compatibility results with actionable failure reasons.
• Run an installed-state preflight before release discovery, downloading, confirmation, sudo, or mutation.
• Inspect the running executable location, expected mutable installation topology, path types and containment, configuration discovery, integration state, service-manager availability, and detectable conflicting ownership.
• Reject unsafe symlinks, incomplete or unexpected layouts, and other conditions that make the release-bundle replacement plan unsafe.
• Define a second candidate-specific preflight after bundle verification and before privileged mutation so new installer requirements are checked by the candidate.
• Keep compatibility based on current observable capability rather than an installation receipt, build flag, declared origin, or distribution-name allowlist.
• Make the check set extensible so additional conservative checks and diagnostics can be added after the updater ships without changing the public command.

Acceptance criteria

• A supported mutable FHS release-bundle fixture passes the initial and candidate-specific preflights.
• Symlinked, incomplete, conflicting, or otherwise incompatible synthetic layouts are refused with concrete reasons.
• Initial incompatibility prevents every release-client, download, confirmation, sudo, and installer call.
• Candidate-specific incompatibility prevents privileged mutation.
• Compatibility logic is covered through injected filesystem, process, service, and ownership facts plus temporary-root integration fixtures.
• Documentation describes the initial checks as an evolving safety boundary rather than an exhaustive host-support declaration.

Out of scope

• A persistent provenance or ownership receipt.
• Compile-time self-update capability declarations.
• Distribution-specific allowlists or support promises.
• Guaranteeing that a privileged upgrade cannot encounter a later runtime failure.
• Downloading, verifying, or applying the candidate bundle.