Releases: VERSION + automatic patch tags + promote; updater installs newer versions (node-26#49)

VERSION holds MAJOR.MINOR (1.1), edited by hand. Every push to main is
tagged vMAJOR.MINOR.PATCH by the "Tag release" workflow, with PATCH counted
as an integer by scripts/next-version.sh. "Promote release" moves the major
tag (v1) to a tested release and refuses to move it backwards.

drb-update.sh: a newer release on the node's channel is now a reason to
update by itself. REF=latest follows the highest vX.Y.Z tag (test nodes);
REF=v1 follows the promoted tag (customer nodes). Versions compare per
field as integers (1.10.0 > 1.9.3, never string or float order). It never
downgrades, and an untagged target still needs a request. After an update
it writes DRB_VERSION to .env; the edge node reports it in checkin.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-edge-node/app/config.py

@@ -6,6 +6,9 @@ class Settings(BaseSettings):
     # Node identity
     node_id: str
     node_name: str = "Unnamed Node"
+    # The release installed on this node (node-26#49). The host updater writes
+    # DRB_VERSION to .env after each update; "untagged" before the first one.
+    drb_version: str = "untagged"
     node_lat: float = 0.0
     node_lon: float = 0.0