feat(compat): gate DSH 0.1.2-rc.1 promotion on evidence

[Altairpaca]

Goal

Turn the DSH 0.1.2-rc.1 migration plan into a machine-enforced promotion contract rather than blindly updating prerelease dependencies.

Change

• add compatibility-candidates.json with candidate state, required checks and upstream blocker references;
• track the two currently unresolved 0.1.2-rc.1 Web/client-modules regressions as explicit blockers;
• add scripts/check-dsh-candidates.mjs validating candidate state, unique blockers/checks and compatibility promotion rules;
• fail if compatibility.json.tested.dshPackages is moved to a blocked/non-ready candidate;
• add node:test coverage proving blocked/ready/promotion semantics;
• wire candidate validation into release:check and expose compat:candidate-check;
• retain the migration contract documenting the legacy and target client graphs.

Evidence boundary

DSHelm continues to claim only the current verified rc.7 baseline. 0.1.2-rc.1 is a blocked candidate until upstream client boot issues are resolved and the full local/package/browser compatibility checks pass.

Refs #20 #29