test: rehearse the stable rooms' upgrade on every canary, and list Sunday's checks

update_canary.sh now also validates the exact package it is about to
publish as an upgrade from whatever stable names — 0.2.2 today, several
releases behind the laptop's canary. A package that upgrades the laptop
and breaks the desktops has to fail before it is published.

The lab print check runs in the Plasma lab as well as a plain container:
its rig lived in /tmp, which is a tmpfs there that docker cp cannot write
into, and its inline-PDF server shared a port with another test server.

docs/testing.md has the physical checks for 0.2.6.1 — paper through
Elmer, the real keyboard's zoom keys, the machine's graphics through
--diagnose, sign-out with a real account — before stable moves.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/test-deployment-support.sh

@@ -245,6 +245,9 @@ check("a spent version is refused before the build",
       canary.index("release_check_new_version") < canary.index("build-release.sh"))
 check("and again after the gate",
       validation < canary.rindex("release_check_new_version") < first_upload)
+check("the stable rooms' upgrade is rehearsed on the same file before publishing",
+      "VALIDATION_CHANNEL=stable" in canary
+      and canary.index("VALIDATION_CHANNEL=stable") < first_upload)
 check("the published channel is read back afterwards",
       canary.index("release_verify_channel canary") > canary.index("release_publish_manifest canary"))
 # The gate checks convergence, not just that the package installs: an