Known issues span a version range (min/max), with public-site ready filter

[passcod]

Summary

• version_known_issues now spans a half-open [min, max) range within a minor branch instead of pointing at a single version. Raising on M.m.p covers every later patch in the minor; resolving names the fix version M.m.f, exclusive — so any patch from the fix onwards is clean again while earlier patches stay flagged.
• The admin UI shows a ready chip per minor based on the latest published patch (an old, since-fixed issue on an earlier patch no longer dims the whole minor).
• The public site (/versions, /versions/update-for/{v}, artifact lists, HTML pages, downloads) only exposes ready versions. update-for keeps offering an earlier ready patch within the same minor when the tip is flagged, instead of skipping the minor entirely.

Schema

Migration 2026-05-21-080000-0000_version_known_issue_ranges replaces version_id with min_major/min_minor/min_patch (NOT NULL) and nullable max_* columns. CHECK constraints enforce same-minor and max_patch > min_patch; resolved metadata and max_* always co-occur. Legacy resolved rows are backfilled as "fixed in the very next patch" — imperfect but the dataset is tiny and operators can re-raise with a more accurate fix version if needed.

Wire changes

• KnownIssueData gains min_major/minor/patch and nullable max_major/minor/patch.
• MinorVersionGroup gains ready: bool.
• ResolveKnownIssueArgs gains required fix_version: string (must be in the same minor as min and strictly above it).
• add_known_issue keeps version_id as input (the "Add" button still lives on a version detail page); server looks up coords from there.
• list_known_issues and get_version_detail.known_issues now return every issue raised against the version's minor — the full timeline, not just issues that pinpoint this exact patch.

UI

• Minor-group accordion summary shows a "Ready" / "Known issues" chip based on the latest patch.
• Each known-issue row shows the affected range string ("Affects 1.0.6 and later in 1.0.x" or "Affects 1.0.6 (fixed in 1.0.9)").
• The resolve dialog now requires a fix version, validated client-side (same minor, above min) and server-side, and defaults to the current page's version when that's a plausible fix.

Public-site filtering

crates/public-server/src/versions.rs wraps lookups in filter_ready / latest_matching_ready. update_for computes "latest ready patch per (major, minor)" itself rather than relying on the version_updates view, which is needed so a broken tip falls back to an earlier ready patch in the same minor.

🤖 Generated with Claude Code