Story: Daemon-side self-upgrade detection + state-file write + detached CLI spawn (HIP steps 0-2)

Part of epic #500 — Self-Upgrade Protocol. Implements HIP XXXX2 self-upgrade **steps 0–2** on the **daemon side** — the trigger that decides self-upgrade is needed and launches the protocol. Currently unowned (the existing stories cover the CLI-child mechanics but not the daemon-side seam).

## Context

The daemon enters the self-upgrade protocol when, while processing a network upgrade, it finds that `provisioner.cli.version` **or** `provisioner.daemon.version` in `infrastructure-versions.yaml` differs from the currently installed versions. Per HIP, **if either differs, both binaries upgrade together** (paired atomic upgrade). The daemon owns only: detect → write state file → download+verify the new CLI → spawn the detached child. The child (#523+) owns the rest.

## Scope

- **Detect version drift:** compare installed CLI/daemon versions (from `internal/state` / `pkg/version`) against the manifest's `provisioner` block. If neither differs, skip the protocol entirely (fall through to the in-place daemon-invokes-CLI infra-upgrade path). If either differs, both are upgraded.
- **Write state file (step 0):** `/opt/solo/weaver/daemon/self-upgrade.yaml` (HIP-authoritative path) capturing `operationId`, `startedAt`, `status: in-progress`, `manifestPath`, and the full `provisioner` block (versions + algorithms + checksums) copied verbatim. See #529 for the schema/writer.
- **Download + verify new CLI binary (step 1):** download `solo-provisioner` for `provisioner.cli.version` to `/tmp/solo-provisioner-v`, verify via #698's promote-gate (signature + manifest checksum), exponential-backoff retry to a configurable max. On exhaustion → CR `Failed` (`DownloadFailed: unreachable after N attempts`) + `SelfUpgradeFailed` event, no further action.
- **Spawn detached child (step 2):** exec the freshly downloaded CLI with `provisioner self upgrade --state-file=/opt/solo/weaver/daemon/self-upgrade.yaml` using #525's detached-spawn mechanics so it survives the old daemon's death.

## Acceptance criteria

- No drift in either version → protocol skipped; in-place infra-upgrade path used.
- Drift in either version → both binaries upgraded (paired).
- State file written before any download (persist-before-act).
- CLI download verified via #698 before spawn; download failure → CR `Failed` + event.
- Detached child spawned via #525; daemon then steps back (child owns 3a–3j).

## Dependencies

- #529 (state-file writer/schema), #698 (verified download/promote), #525 (detached spawn), #523 (the child command being spawned).
- Triggered from the execute-phase orchestration in epic #502 (story 5.4); coordinate the seam there.

Start with the execute-phase orchestration in epic #502, then inspect internal/state and pkg/version for installed-version handling. Read #529, #698, #525, and #523 to understand the state-file, verified-download, detached-spawn, and child-command seams. Done means drift detection, persist-before-act ordering, verified download failure handling, and detached spawn satisfy the listed acceptance criteria.

Written by the indexing model from the issue text.