test(tmachine): qualify DEB and RPM package upgrades

[elezar]

Summary

Add tmachine package-upgrade qualification for Ubuntu DEB and Fedora RPM installations. Each lane installs the latest retained prerelease package set and matching runtime images, upgrades to candidate artifacts built by the current workflow, and verifies gateway and sandbox continuity.

Related Issue

No issue required: this is a localized release-qualification test scaffold extending the existing packaged integration architecture.

Changes

• Stage the latest retained prerelease DEB or RPM artifacts with checksum verification and matching runtime images.
• Build candidate DEB and RPM artifacts for the label-gated test:upgrade PR path; candidate RPMs use the Fedora container packaging workflow.
• Add tmachine source installers for Ubuntu/Docker DEB and Fedora/rootless-Podman RPM packages.
• Verify exact RPM replacement, gateway recovery, an existing sandbox marker, and a newly created sandbox after upgrade.
• Run both upgrade lanes in Release Dev and Release Tag qualification matrices.
• Keep DEB and RPM source inputs isolated so both formats can run from one prepared integration artifact.

Testing

• mise run pre-commit passes
• nix fmt tests/config.nix
• nix build .#tmachine-config --no-link
• Ansible syntax checks for DEB and RPM source/install/upgrade playbooks
• actionlint for modified branch and release workflows
• Retained v0.1.0-pre.4 RPM artifact filenames and checksums verified against staging selectors
• Full tmachine upgrade runs (require candidate workflow artifacts and KVM)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3521.docs.buildwithfern.com/openshell

[elezar]

/ok-to-test 878d186

[elezar]

/ok-to-test c8ab35d