Add source-aware upgrade-fit release view

[PollyBot13]

Summary

Adds a source-aware upgrade view on top of the install-profile release radar:

• adds an I’m on current-version selector and upgrade-path ledger
• adds /api/upgrade-path so upgrade comparisons can use full server-side attribution instead of capped public issue samples
• introduces upgrade-fit scoring that answers “is this upgrade worth doing from my current version?” instead of reusing the target release’s global install score
• keeps no-current global/profile recommendation mode separate from selected-current upgrade mode
• tightens evidence wording and quality buckets: confirmed risks, unverified reports, fixed issues, and contextual carried risks
• adds a fixture smoke test covering real public payload shape plus server-backed bucket behavior

No existing issue looked like the right parent for this slice, so this PR stands alone.

Reasoning

The previous release score answered a static question: “would I install this release today?” That is useful, but it breaks down when the user is already on a specific version. A weak current version creates upgrade pressure; a newer target may fix real pain even if the target’s global score is not perfect. Conversely, a decent current version should not make a barely-settled target look like an obvious move.

This PR separates those concepts:

• Global score remains broad release quality.
• My install score personalizes global quality when the user has a complete setup profile and no current version selected.
• Upgrade fit is source-relative: it weighs source pressure, target quality, fixed vs newly seen risk, transition size, and evidence quality.

A few UX decisions came out of testing the preview:

• In no-current mode, the recommendation should not blindly prefer the newest server-recommended row if an older eligible row is much stronger. The UI now keeps the newest preference only when it is within a small score margin of the best eligible release.
• In selected-current mode, global/profile recommendation pills are suppressed unless the upgrade-fit candidate clears the upgrade threshold.
• The selected current row is shown as a baseline, not another install candidate.
• Unfiltered issue evidence is labelled as relevant/watch evidence, not personally “related” evidence.
• Missing quality metadata is treated as unverified, never confirmed.

Verification

• git diff --check
• npm run test:upgrade-path-fixture
• npm run typecheck
• npm test (113 passing)
• npm run build
• live sample API checks against classified sample DB
• PinchTab browser readback on the preview, with no browser errors
• final reviewer pass: one blocking finding fixed before this PR was opened; second pass recommended ship with only residual unit-coverage risk around API quality bucketing