upgrade: extend patch-only auto-upgrade gate to explicit `altimate upgrade` + pre-migration DB backup

Found during v0.9.1 release review (Chaos-Gremlin). (1) The new patch-only gate (`installation/index.ts:~59`, `cli/upgrade.ts:~147`) only protects the SILENT background auto-upgrade; the explicit `altimate upgrade` command has no release-type gating, so a cron/CI/aliased `altimate upgrade` jumps across minor/major unattended. Add confirmation (or gating) when the resolved target is a minor/major bump and no explicit `--target` was given. (2) No pre-migration DB backup before first launch alters schema — add an opt-in/automatic snapshot of `opencode.db` for a rollback path.