Releases: VERSION + automatic patch tags + promote; updater installs newer versions (node-26#49)

VERSION holds MAJOR.MINOR (1.1), edited by hand. Every push to main is
tagged vMAJOR.MINOR.PATCH by the "Tag release" workflow, with PATCH counted
as an integer by scripts/next-version.sh. "Promote release" moves the major
tag (v1) to a tested release and refuses to move it backwards.

drb-update.sh: a newer release on the node's channel is now a reason to
update by itself. REF=latest follows the highest vX.Y.Z tag (test nodes);
REF=v1 follows the promoted tag (customer nodes). Versions compare per
field as integers (1.10.0 > 1.9.3, never string or float order). It never
downgrades, and an untagged target still needs a request. After an update
it writes DRB_VERSION to .env; the edge node reports it in checkin.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/next-version.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# node-26#49 — the release tag this commit should get, or nothing if it has one.
+#
+# VERSION holds MAJOR.MINOR and is edited by hand. PATCH is automatic: one
+# more than the highest existing vMAJOR.MINOR.PATCH tag, compared as an
+# integer (so .10 follows .9), starting at 0 for a new MAJOR.MINOR.
+#
+# Usage: scripts/next-version.sh   (from the repo root, tags fetched)
+set -euo pipefail
+
+base="$(tr -d ' \r\n' < VERSION)"
+[[ "$base" =~ ^[0-9]+\.[0-9]+$ ]] || { echo "VERSION must be MAJOR.MINOR, got '$base'" >&2; exit 1; }
+pattern="^v${base//./\\.}\\.[0-9]+$"
+
+if git tag --points-at HEAD | grep -qE "$pattern"; then
+  exit 0   # this commit is already released
+fi
+
+last="$(git tag -l "v${base}.*" | grep -E "$pattern" | sed "s/^v${base}\.//" | sort -n | tail -1 || true)"
+echo "v${base}.$(( ${last:--1} + 1 ))"