feat: gate upgrades with compatibility matrix

infra/production/UPGRADE_ROLLBACK.md

@@ -0,0 +1,18 @@
+# Upgrade and Rollback Runbook
+
+The compatibility gate is mandatory before every deployment or rollback:
+
+```bash
+bash packages/casan-harness/scripts/bash/upgrade-compatibility.sh check \
+  --from 1.0.0 --to 1.0.1
+```
+
+Only an explicit rule in `compatibility-matrix.json` can permit a version pair.
+Before rollout, verify provenance, create and verify a state backup, smoke the
+extracted artifact, deploy immutable image digests, and verify an Evidence Pack
+after deployment. A rollback requires the same gate with `--rollback`, plus an
+approved change record and a verified backup.
+
+Do not infer compatibility from matching image tags, passing unit tests, or
+successful container startup. Add and review a new matrix entry before any
+cross-minor or cross-major migration.

infra/production/compatibility-matrix.json

@@ -0,0 +1,18 @@
+{
+  "schema_version": "1.0",
+  "product": "CASAN",
+  "rules": [
+    {
+      "from": "1.0.x",
+      "to": "1.0.x",
+      "policy_schema": "1",
+      "evidence_pack_schema": "1.0-mvp",
+      "rollback": "supported",
+      "notes": "Patch-level upgrades only. Back up runtime state and verify the candidate artifact before rollout."
+    }
+  ],
+  "unsupported": [
+    "Cross-major upgrades require a reviewed migration entry before deployment.",
+    "Downgrades that change policy or Evidence Pack schema are denied until an explicit rollback entry is added."
+  ]
+}