persistence: multi-version reads across every store

ProcessJobStore and SubstrateStore already implemented the
loader-accepts-any-version-in-[1, kVersion] pattern.  The other five
stores (ControlJobStore, CarrierStore, LoadPortStore, ExceptionStore,
SpoolStore) used strict `header[1] != kVersion` rejection, meaning
a future kVersion bump there would silently nuke every persisted
record on first replay.  That's a footgun the test_persistence_upgrade
test already flagged as a tripwire.

This commit flips the strict checks to `< 1 || > kVersion`, mirroring
PJ + Substrate.  No format change (kVersion stays at 1 across the
five stores), but:

- Future v2 of any store now Just Works: add fields at the end of
  write_record_, bump kVersion to 2, gate the new reads behind
  `if (version >= 2)`.  Old v1 records on disk continue to replay
  with the new fields defaulted.
- Future versions beyond kVersion still get rejected (downgrade
  protection — older code can't try to decode trailers it doesn't
  understand).

Comment blocks on each kVersion declaration now describe the upgrade
discipline so the next contributor doesn't reinvent it.

Test additions:
- Positive test that v1 ControlJob records load on current code
  (will continue to pass when kVersion bumps to 2, proving v1 is
  still readable)
- ExceptionStore rejects a v9 (future) record, matching CJ + Carrier
- The existing tripwire tests get retitled from "rejects unknown
  version" to "rejects a future version" to reflect the new contract

README §6 gets honest: every store is now multi-version-aware, not
just PJ + Substrate.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

include/secsgem/gem/store/control_jobs.hpp

@@ -160,10 +160,18 @@ class ControlJobStore {
     ControlJobState state;
   };
 
-  // CJ record:
-  //   [u8 magic = 0xC8][u8 version = 1][u8 state]
+  // CJ record (v1):
+  //   [u8 magic = 0xC8][u8 version][u8 state]
   //   [u16 ctljobid_len][ctljobid_bytes]
   //   [u16 pj_count][repeat: u16 len + bytes]
+  //
+  // Upgrade discipline: when adding fields, bump kVersion and append
+  // the new fields at the end of the on-disk record.  The loader
+  // accepts any version in [1, kVersion]; older records replay with
+  // the trailing fields defaulted.  Future versions read by this
+  // binary surface as a rejection (so a downgrade can't silently
+  // corrupt data), but the same code that bumped kVersion to N must
+  // also gate the new trailer behind `if (version >= N)`.
   static constexpr uint8_t kMagic   = 0xC8;
   static constexpr uint8_t kVersion = 0x01;
 
@@ -223,7 +231,8 @@ class ControlJobStore {
     if (!in) return std::nullopt;
     uint8_t header[3];
     in.read(reinterpret_cast<char*>(header), sizeof(header));
-    if (!in || header[0] != kMagic || header[1] != kVersion) return std::nullopt;
+    if (!in || header[0] != kMagic ||
+        header[1] < 1 || header[1] > kVersion) return std::nullopt;
     Record r;
     r.state = static_cast<ControlJobState>(header[2]);
     auto read_str = [&](std::string& out) {