test(tmachine): qualify DEB and RPM package upgrades

[elezar]

Summary

Add tmachine package-upgrade qualification for Ubuntu DEB and Fedora RPM installations. Each lane installs the latest retained prerelease package set and matching runtime images, upgrades to candidate artifacts built by the current workflow, and verifies gateway and sandbox continuity. A raw-wire storage migration converts pre.4 network endpoint mode strings before current-schema protobuf decoding.

Related Issue

No issue required: this is a localized release-qualification test scaffold extending the existing packaged integration architecture.

Changes

• Resolve one successful retained prerelease, stage its DEB and RPM artifacts with checksum verification, and export its matching runtime images once for both upgrade lanes.
• Build candidate DEB and RPM artifacts on every approved branch run; candidate RPMs use the Fedora container packaging workflow.
• Keep only runtime-image preparation and tmachine upgrade execution behind the test:upgrade label.
• Migrate persisted pre.4 NetworkEndpoint TLS, enforcement, and access strings to their current enum representation during SQLite and PostgreSQL startup and before record decoding.
• Add tmachine source installers for Ubuntu/Docker DEB and Fedora/rootless-Podman RPM packages.
• Wait for SSH before running upgrade assertions and use sandbox names accepted by the retained prerelease gateway.
• Verify exact RPM replacement, gateway recovery, an existing sandbox marker, and a newly created sandbox after upgrade.
• Run both upgrade lanes in Release Dev and Release Tag qualification matrices.
• Keep DEB and RPM source inputs isolated so both formats can run from one prepared integration artifact.

Testing

• mise run pre-commit passes
• nix fmt tests/config.nix
• nix build .#tmachine-config --no-link
• Ansible syntax checks for DEB and RPM source/install/upgrade playbooks
• actionlint for modified branch and release workflows
• Retained v0.1.0-pre.4 RPM artifact filenames and checksums verified against staging selectors
• Full ARM64 tmachine DEB and RPM upgrade scenarios reproduced locally; both pass guest readiness, source setup, sandbox creation, and candidate package installation
• Focused pre.4 raw-wire migration, unknown-value rejection, and idempotency tests
• Complete openshell-server test suite with test-support
• Full post-upgrade continuity assertions with migration-enabled candidate packages (label-gated CI)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3521.docs.buildwithfern.com/openshell

[elezar]

/ok-to-test 878d186

[elezar]

/ok-to-test c8ab35d

[elezar]

/ok-to-test c9f262b

[elezar]

The upgrade qualification is currently blocked by a product-level persisted-storage compatibility issue between v0.1.0-pre.4 and HEAD.

Both the DEB and RPM scenarios now pass guest readiness, install the retained prerelease, create the source sandbox, and install the candidate packages. After the candidate gateway restarts, it cannot decode the persisted sandbox protobuf. The observed failures report wire-type mismatches for NetworkEndpoint.enforcement and NetworkEndpoint.tls (LengthDelimited versus Varint).

Initial tracing points to the NetworkEndpoint field-type changes introduced in e38d7254e6099a42d6b80329b8e4ef6f0817931f / #3187, between pre.4 and pre.5. A separate investigation is determining whether this was an intentional compatibility break or requires a storage migration or legacy decoder. Until that is resolved, the package-upgrade tests cannot complete their post-upgrade sandbox continuity assertions.

[elezar]

The pre.4-to-HEAD storage blocker described above is now addressed by commit 262732e80.

The existing raw-wire compatibility layer now traverses message-valued protobuf maps and converts legacy NetworkEndpoint fields 4–6 from strings to their current enum varints before Prost decoding. The migration runs for both SQLite and PostgreSQL startup and remains active as a read-time fallback. Focused legacy fixtures, unknown-value rejection, idempotency coverage, and the complete openshell-server test suite pass.

The remaining confirmation is the label-gated DEB/RPM qualification run using packages built from this commit.

[elezar]

/ok-to-test 262732e