release: in-cluster upgrade receipt and pre-upgrade validation hook

The cluster needs to record which stack version it is running, because nothing else does. Helm knows chart versions per release; there is no bundle-level version anywhere in cluster state.

• A ConfigMap recording installed stack version, bundle digest, and per-migration completion status.
• A pre-install/pre-upgrade hook that reads it, compares against the target bundle, and exits non-zero before any workload changes if the customer is skipping a required major or a required migration has not completed.

The check itself is small — comparing two parsed semver values plus a ConfigMap read. It runs as a Helm hook rather than a client-side check in Makefile.dist because a client-side check is bypassable by invoking helmfile apply directly, and the failure it prevents (a partially upgraded control plane over un-migrated data) is expensive.