feat: add transactional upgrade rollback

[shakkernerd]

Summary

• add ocm upgrade rollback for explicit, transactional restoration of the runtime, environment snapshot, binding, and managed service state captured before an upgrade
• reject stale, incomplete, shared, drifted, tampered, or already-reversed transactions before mutation, including unsafe runtime-only downgrades
• serialize upgrade-family operations, preserve backward-compatible history, and expose linked rollback records through human, raw, and JSON output
• document the command and cover success, reversal, refusal, cleanup, launcher, runtime, service, and history paths

Verification

• AWS Crabbox cbx_a55a7013c2d7: cargo test --locked
• AWS Crabbox cbx_a55a7013c2d7: cargo check --locked --all-targets
• AWS Crabbox cbx_a55a7013c2d7: cargo check --locked --target x86_64-pc-windows-gnu
• real OpenClaw upgrade, rollback, durable-state comparison, and re-upgrade across 2026.6.11, 2026.6.33, 2026.7.1, 2026.7.1-2, 2026.7.2-beta.3, and frozen source ec8f957f reporting 2026.7.2
• unsafe 2026.7.2 to 2026.7.2-beta.3 runtime-only downgrade rejected before state, snapshot, or history mutation

Follow-up

Separate compatibility-hardening PRs will extend the general environment operation lock across the complete normal-upgrade path and make failed-rollback audit-record cleanup resilient if history persistence itself fails. The explicit rollback path in this PR already holds its operation lock for the full rollback and restores state before recording a rollback failure.