Trim safe serve upgrade to drain, restore, and retire (MN-REQ-06.14)

[chouswei]

Summary

Trims the squash-merged safe-upgrade cut (#208) to what a standalone memnet serve needs: save every loaded session, restart on the new version, reload every session. MN-REQ-06.14 and MN-VER-06-S12 are narrowed first. Version stays 0.19.21. No changelog version section. Not merged.

Kept

• Admin drain memnet admin upgrade-prepare (MEMNET_ADMIN_TOKEN): quiesce, @ERR: serve_draining|retry_after_s=<seconds>, and the in-flight wait.
• Lossless snapshot of every loaded session, the manifest (counts and checksums), and the unsaveable block plus --allow-unsaved.
• Startup restore with the same session ids, ACL bindings, TTL clock, and house, and @STAT: upgrade_restore|ok|n|failed|m.
• Loud failure that leaves the snapshot files untouched and does not retire.
• Retire after a clean restore, now automatic inside that startup, so a later restart does not replay the snapshots.

Removed

• Client retry in memnet-mcp and the product gateway (MEMNET_UPGRADE_RETRY_S). Clients see the normal refusal or a connection error during the restart.
• The memnet-upgrade helper (systemd ExecStart swap, gateway pin edit, unit rollback, and the clients-ready gate).
• The operator upgrade-retire command. Serve retires a clean manifest itself.

Operator note: docs/operations/safe-upgrade.md is the short procedure (install the new venv, upgrade-prepare, check ready-to-stop, restart the unit, read the restore stat). Rollback is pointing the unit at the old venv.

Tests

tests/test_safe_upgrade.py and tests/test_sysml_safe_upgrade.py: ACL, near-expiry TTL, and a near-cap graph; unsaveable blocks ready-to-stop; a corrupt snapshot fails loud and stays on disk; an older format v1 loads; an unsupported format leaves the file; drain refuses new work while in-flight commands finish; a clean restore retires and a later start does not replay; TCP restart keeps the same id, then a further restart does not replay.