test(e2e): codify the miner-0 control-upgrade run as an 'upgrade' phase in e2e-real.sh (#322)

[VijitSingh97]

Closes #322. Stacked on #324 (which stacks on #323) — the noop leg asserts the terminal noop status #320 introduces. Merge order: #323 → #324 → this; GitHub retargets automatically.

Both real bugs in the remote-upgrade chain — #308's missing-$HOME "dubious ownership" silent git death (v1.11.1) and #318's origin/HEAD-resolves-to-develop refusal (v1.11.2) — were caught only by a real-hardware miner-0 control-upgrade run, invisible to the unit suite by design (it stubs git). That run lived only in changelog references; now it's a repeatable phase.

The phase

• noop leg — POST the installed version and poll the real receiver → path unit → root oneshot → /status round trip to terminal noop. Proves the whole wire without touching the tree, and never dials GitHub.
• rollback leg — forge a local tag (git commit-tree, no HEAD move, no dirty tree) on a commit unreachable from origin/main; the D10 ancestry guard refuses the forward leg and the verb rolls back to the running ref. Asserts rolled_back, checkout + VERSION + miner intact, and the D6 throttle stamp. This drives the real git calls as the root oneshot with no $HOME — the ADR 0002 + remote control-upgrade capability (Pithead worker-upgrade producer) #308 class dies here, not in the stubbed suite.
• forward leg (opt-in, E2E_UPGRADE_TARGET=vX.Y.Z) — a real upgrade polled to applied with VERSION asserted; permanent, so not part of the repeatable default. This is the release-flow leg that would have caught control-upgrade reachability guard breaks on fresh clones (origin/HEAD -> develop) #318.

Reuses control()'s snapshot/cleanup machinery (CTL_ globals + _control_cleanup, which now also forces control_upgrade off) plus removal of the phase's own leftovers (probe tag, throttle stamp). Runs inside all between control and perf — same restart-churn rationale as control. Also the producer half of pithead#597's cross-repo tier-4 gate.

Validated on real hardware (miner-0, 2026-07-19)

Two full runs of the phase on miner-0 with this branch checked out:

• First cold run exposed a real race: with every core pinned by the miner, the freshly-enabled DynamicUser receiver took >3s to bind and the first POST read connection-refused. Fixed with a polled receiver-up gate (authed GET /status, 200/503 = serving, up to 30s) — control()'s single-shot check, retried.
• Final cold run (control disabled → enabled from scratch): PASS, 12/12 — the gate caught the receiver on try 2, the noop leg reached terminal noop (first real-hardware validation of the control-upgrade status contract: no in-progress state, no version echo, refusals collapse into 'failed' #320 contract), the rollback leg reached rolled_back with the tree, VERSION, and a live 10.7 kH/s miner intact, and the throttle stamp was written. Rig restored to its v1.11.2 baseline afterward (config, tag checkout, no probe tag/stamp, control off, lock free).

bash -n, make lint, make lint-md, and the full unit suite (1494 passed) are clean; docs updated in the script header, tests/README.md, RELEASING.md, and the CHANGELOG.

🤖 Generated with Claude Code