Upgrade test: what an existing user gets from the next release

Every test so far installs fresh. Nothing took a machine on the last
release and updated it, which is what most users of a new release do.

test/upgrade-test takes an installed system, moves it to edge or rc with
omarchy-channel-set in a login shell, as a user would, reboots it
through the firmware so the new kernel is the one that starts, and
checks eleven things: the update's exit status, skipped migrations, that
the reboot comes back by itself, into a new boot and an installed
kernel, the channel, the system's state, failed units, the desktop, the
wallpaper the user had, and the boot menu. It writes a report and takes
a picture of the unlocked desktop before and after. A reboot that only
comes back after a key press is a failure, and is said to be that.

The Upgrade test workflow installs a release from its signed ISO with
the install test, then runs it. It is started by hand, and runs for a
pull request that changes the test. A second job, the only one that can
write, commits the pictures to the upgrade-test-screenshots branch and
posts the report as one comment on the branch's pull request, updated in
place on later runs.

Run by hand from 4.0.4 to today's edge it found two things: the
wallpaper link left pointing at a file the update renamed
(omacom/omarchy#14596), and one reboot in three stuck on a black screen
until a key was pressed (omacom/omarchy#14771).

README.md

@@ -263,6 +263,25 @@ The first scenario is `factory-reset`: it proves `omarchy-system-factory-reset`
 
 Artifacts — screenshots, the fixtured/staged/final `limine.conf`, the reset typescript, and the factory-reset log — land under `test-runs/<iso>-integration/runs/<timestamp>-<scenario>/`, and `--no-preview` skips the `imv` review just like the acceptance harness.
 
+## Upgrade testing
+
+`test/upgrade-test` checks what an existing user gets. It takes an installed system, moves it to another channel with `omarchy-channel-set`, reboots it, and checks what came back: the update's exit status, skipped migrations, that the reboot comes back by itself into an installed kernel, failed units, the desktop, the user's wallpaper and the boot menu.
+
+```bash
+./test/integration release/omarchy.iso boot                                # installs once, leaves the installed disk
+./test/upgrade-test test-runs/omarchy-integration edge upgrade-evidence    # edge or rc
+```
+
+The evidence folder gets `report.md`, the update's output, and a picture of the desktop before and after.
+
+The "Upgrade test" workflow does both steps from a release's ISO. Start it by hand, from the latest release to edge by default:
+
+```bash
+gh workflow run upgrade-test.yml -f to=edge
+```
+
+When the branch it ran on has a pull request, the result is posted there as one comment and updated in place on later runs.
+
 ## Signing the ISO
 
 Run `./bin/omarchy-iso-sign [release/omarchy.iso]`. The signing key is retrieved from the shared Omarchy vault with the 1Password CLI.