v0.86.0: Phase 2 managed updates — floor-driven auto-update

The controller honors an operator-enforced minimum version (FLOOR) on the hub
report ACK and auto-updates to the floor when below it (managed default, no click),
reusing the Phase 1 in-guest-pull + agent-swap + rollback. Latest stays the opt-in
button; the floor is the auto-target, never latest.

- pusher.go: PushResponse += min_controller_version, latest_version (existing ACK seam)
- main.go: OnPushResponse → updater.SetFloor + MaybeAutoUpdate (rides report cycle)
- updater.go: SetFloor/GetFloor + MaybeAutoUpdate reusing performUpdate (auto-floor);
  no-op at/above floor, floor>latest, dev/no-agent/backup; no flap (in-mem+persisted)
- settings UI (HU): floor display + auto restart-poll during an auto-update
- tests: below/at/floor>latest/no-flap/raised-floor; below-floor red-proof verified
- no agent change (reuses Phase 1 POST /controller/swap)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FSZmmSFVzGwEzhYmxbkgBK

controller/internal/report/pusher.go

@@ -26,6 +26,12 @@ type PushStatus struct {
 type PushResponse struct {
 	Status          string `json:"status"`
 	CustomerBlocked bool   `json:"customer_blocked"`
+	// Phase 2 managed updates: the effective controller-version FLOOR (the operator's enforced
+	// minimum) and the latest available version. Empty when the hub has none configured / is old.
+	// The controller auto-updates to the floor when below it (latest stays the customer's opt-in
+	// "update to latest" button — never the auto-target).
+	MinControllerVersion string `json:"min_controller_version"`
+	LatestVersion        string `json:"latest_version"`
 }
 
 // Pusher sends reports to the central hub.