Story 5.9 — Implement runtime infrastructure version safety-gate (ManifestInvalid)

**Epic:** #502 — Network Upgrade Workflow (Execute Phase)

Implement the runtime infrastructure version safety-gate. (Manifest `schemaVersion` parse-time
validation already exists in `pkg/manifests/infrastructure_versions.go`; this story adds the
runtime installed-vs-declared check.)

**Acceptance criteria:**
- Before any infra upgrade step, validate that installed operator and daemon versions meet the declared minimums in `infrastructure-versions.yaml`.
- If any installed component is below the declared minimum (or the manifest fails schema/semantic validation), emit a `ManifestInvalid` event and halt the execute workflow via the DaemonResult handshake (DaemonResult=False → PendingNodeUpgrade).
- The halt requires manual operator intervention (upgrade the infra stack first, then re-run).

**Depends on:** #539 (infra-versions placement), #706 (orchestration skeleton).