Story: Self-upgrade version-compatibility gate + --override-version-check (HIP step 3b)

Part of epic #500 — Self-Upgrade Protocol. Implements HIP XXXX2 self-upgrade **step 3b** (version-compatibility gate), which is currently unowned by any story.

## Context

After the detached `provisioner self upgrade` child reads the state file (step 3a), but **before any binary is downloaded or installed**, it must validate that every infrastructure component version declared in `infrastructure-versions.yaml` falls within the range this CLI release supports — the same compatibility matrix the CLI already applies for K8s/operator/host binaries, now extended to `provisioner.daemon.version`.

## Scope

- **Compatibility check (default = hard stop):** for each component in the manifest, compare the declared version against this CLI's built-in supported range. On any incompatibility:
- Emit a structured journald error listing every incompatible component, the version specified, and the accepted range, e.g.
`version incompatible: provisioner.daemon.version=0.29.0 (accepted: >=0.31.0); infrastructure.k8s.version=1.28.0 (accepted: >=1.29.0)`
- Emit a `VersionIncompatible` K8s **Warning** event (via the shared recorder from #544).
- Write a `VersionIncompatible` JSONL entry to the upgrade event log.
- Set the `NetworkUpgradeExecute` CR status to `Failed`, reason `VersionIncompatible`.
- Abort with `SelfUpgradeFailed` **before any files are modified** — no partial upgrade.
- **Operator escape hatch `--override-version-check`:** when set, the CLI logs a prominent `WARNING: version compatibility check bypassed by operator` durably to journald + K8s Warning event + JSONL, then proceeds. This flag is an emergency tool only (council-coordinated recovery) and is **not** part of the automated path.
- **Never bypass checksum/signature:** the override flag suppresses only the compatibility check. Integrity verification (#698) is a security control and is always enforced.

## Acceptance criteria

- Incompatible manifest → hard stop, CR `Failed`/`VersionIncompatible`, no files touched.
- `--override-version-check` proceeds but emits the durable WARNING on all three channels.
- Override never suppresses checksum/signature verification.
- New CLI flag documented in `docs/quickstart.md` per repo convention.

## Dependencies

- Shared K8s event recorder (#544, epic #502).
- Runs inside the `provisioner self upgrade` child (#523).