Story: Write self-upgrade state file embedding full provisioner block, operationId, startedAt, status

Part of epic #500 — Self-Upgrade Protocol.

Write the self-upgrade state file at the **HIP-authoritative path** `/opt/solo/weaver/daemon/self-upgrade.yaml` (HIP XXXX2 step 0, line 1588) — corrected from the earlier `/opt/solo/weaver/provisioner/...` path. The detached child (`--state-file`) and `network upgrade recover`/`diagnose` (#717/#718) all read this exact path, so it must be authoritative.

## Scope

Write the state file capturing operation metadata plus the full `provisioner` block copied verbatim from `infrastructure-versions.yaml`, so the detached child and recovery tooling need not re-read the original manifest:

```yaml
operationId: "upgrade-20260415T143000Z-v0.75.0"
startedAt: ""
status: "in-progress" # in-progress | succeeded | recovery-succeeded | failed
manifestPath: "/opt/hgcapp/services-hedera/HapiApp2.0/data/upgrade/current/manifests/infrastructure-versions.yaml"
provisioner:
cli: { version: "0.42.0", algorithm: "sha256", checksum: "abc123..." }
daemon: { version: "0.33.0", algorithm: "sha256", checksum: "def456..." }
```

- Atomic write (tmp + rename), `completedAt` stamped on terminal transitions.
- This file is the primary diagnostic artifact when the node has no daemon running and no cluster reachable.

## Acceptance criteria

- File written to `/opt/solo/weaver/daemon/self-upgrade.yaml` (single authoritative path).
- Embeds `operationId`, `startedAt`, `status`, `manifestPath`, full `provisioner` block.
- Status transitions: `in-progress` → `succeeded` | `recovery-succeeded` | `failed`.
- Atomic write; safe to read mid-write by recovery tooling.