Fix durable state schema migration

[bigboateng]

What changed

• Treat durable state schema 6, rather than schema 4, as the sole supported predecessor of schema 7.
• Preserve schema-6 planning and control-bundle fingerprints during promotion.
• Reject schema-6 payloads that attempt to smuggle the schema-7 human identity role.
• Exercise the real schema-6 to schema-7 installation reconciliation path.

Why

PR #227 advanced durable state directly from schema 6 to schema 7, but the compatibility constant and migration fixture still named schema 4. That made valid schema-6 installations unreadable after upgrade and accepted the wrong predecessor contract.

Impact

Existing schema-6 installations can be promoted to schema 7 without losing their already-valid fields. Older schema versions remain intentionally unsupported.

Validation

• go test ./internal/softwaredelivery/durable ./internal/softwaredelivery/effects
• python3 .github/scripts/run_go_tests.py (552 tests)
• go test -race ./...
• go vet ./...
• go build ./...
• git diff --check

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.