test(upgrade): qualify RPM package upgrades

[elezar]

Summary

Add Fedora RPM package-upgrade qualification with rootless Podman, stacked on the Debian upgrade PR #3521. Install the latest published stable release (currently v0.1.2) with its original version-tagged runtime images and package defaults, upgrade to candidate RPMs, and verify gateway recovery plus existing and new sandboxes.

Related Issue

Depends on #3521. Merge that base PR first; this draft targets codex/ubuntu-deb-upgrade-test.

Refs #2975 — reusable N-to-N+1 upgrade qualification. This PR adds the RPM lane on top of the Debian and shared infrastructure in #3521. Shared release-source/runtime-image preparation and storage, driver-fence/bootstrap, and supervisor compatibility fixes remain in #3521. Existing fresh-install RPM coverage is already on main.

Changes

• Add released RPM source installation and candidate upgrade playbooks with exact package-version checks, sandbox continuity checks, and failure diagnostics.
• Download and checksum-verify released CLI and gateway RPMs, using the shared source-release resolution and runtime-image export from test(tmachine): qualify Debian package upgrades #3521.
• Add the rpm-upgrade-source installer and rpm-upgrade testsuite to tmachine.
• Add Fedora rootless Podman upgrade rows to label-gated branch qualification and Release Dev/Release Tag matrices, with corresponding CI, label-help, and release-canary skill text.
• Keep released source image tags and package defaults; set runtime image overrides only for locally built candidate images.

Testing

• actionlint passes for .github/workflows/{branch-e2e,e2e-label-help,prepare-integration-inputs,release-dev,release-tag}.yml using the cached actionlint 1.7.12 binary.
• Ansible syntax checks pass for tests/ansible/playbooks/openshell-{deb,rpm}-upgrade-source.yaml and tests/ansible/playbooks/upgrade/{deb,rpm}.yaml with ANSIBLE_CONFIG=tests/ansible/ansible.cfg uv run --with ansible-core ansible-playbook --syntax-check.
• nix build .#tmachine-config --no-link passes.
• mise run pre-commit passes.
• Restored tree matches the previous combined head febf3be3238b48dc0fbf0f17d3a0a9ecd58aac15; stacked delta contains only the 10 RPM qualification and documentation files.
• Full live latest-release-to-candidate upgrade qualification has not been run.
• Full mise run ci has not been run; validation is scoped to this mechanical test-scaffold extraction.

Checklist

• Follows Conventional Commits.
• Commit is signed off (DCO).
• Related CI documentation and release-canary skill updated; no new architecture or product configuration changes.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4202.docs.buildwithfern.com/openshell