Upgrade-source affinity and regression contracts

Represent the selected release origin as an explicit UpgradeSource and thread it through discovery, normalization, tag filtering, validation, delta resolution, GitHub/GHCR requests, changelogs, nightly commits, summaries, caches, and full-download fallback. Build URLs from that source rather than fixed repository constants; prefer parameters over mutable globals. Keep legacy unprefixed-tag APIs with optional trailing source parameters defaulting to PRIMARY_UPGRADE_SOURCE, while internal source-aware paths require an explicit source. Tests must assert exact repositories, URLs, token scopes, manifests/blobs, patch requests, spawned arguments, channels, hints, caching, and offline behavior. Allow source fallback only on typed HTTP 404 and cache fallback only after transport failures; prove unrelated sources are never contacted.