persistence: v1->v2 upgrade test + honest README

README §6 claimed bidirectional forward-compat for journal records.
Reality is narrower:

- ProcessJobStore (kVersion=2) and SubstrateStore (kVersion=2) accept
  v1 records on replay — their loaders explicitly switch on the version
  byte and treat the v2 trailer fields as empty when absent.  This is
  the actual upgrade path the README half-described.

- ControlJobStore, CarrierStore, LoadPortStore, ExceptionStore, and
  SpoolStore use strict `header[1] != kVersion` rejection.  A future
  kVersion bump there without a matching loader-side dispatch would
  silently nuke every replayed record.  The README sold this as a
  feature; it isn't yet.

This commit adds:

- tests/test_persistence_upgrade.cpp: five cases that craft journal
  records byte-by-byte so format drift is caught (no codec round-trip
  hiding the field layout).  PJ v1 -> v2 read; PJ v1 rewrite stamps
  current kVersion=2; PJ unknown future version rejected; Substrate
  v1 read with empty history trailer; CJ + Carrier reject unknown
  versions (tripwire for the strict-version stores).

- README §6: replaces the rosy "newer versions ignore unknown
  trailers" claim with what's actually implemented — multi-version
  reads on PJ + Substrate, strict equality elsewhere — and points
  at the test as the contract anchor.

When the strict-version stores grow their own v2, the rejection
tests will need to flip to acceptance; the layout is right there in
the test so the edit is mechanical.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

CMakeLists.txt

@@ -141,6 +141,7 @@ add_executable(secsgem_tests
   tests/test_identifier_wildcards.cpp
   tests/test_concurrency.cpp
   tests/test_thread_safety.cpp
+  tests/test_persistence_upgrade.cpp
 )
 target_link_libraries(secsgem_tests PRIVATE secsgem doctest::doctest)
 target_compile_definitions(secsgem_tests PRIVATE