Implement nightly upgrade, heavy, end-to-end, and security acceptance

[litroc]

Context

Implements LI-122, MLX-100, and REL-30.

Scope

Run upgrade, idempotency, Heavy, end-to-end, and security acceptance against the exact candidate set while consuming revision-bound source evidence.

Acceptance criteria

• Positive fixture passes installation, upgrade, idempotency, Heavy, E2E, and security gates.
• Deliberately incompatible fixture is blocked.
• Installed collection, runtime, and dependency versions are verified.
• Missing, stale, or contradictory evidence fails closed.
• Results bind candidate and environment digests.
• PRs, runs, and evidence are linked here and to LI-122.