[Feature] V2 forward-runtime bridge: CLI_UPDATE_REQUIRED for future releases (PR-0B) #157

Problem

A V2 runtime that sees a future (V3) release reports
UPDATE_INTEGRITY_METADATA_MISSING — "no lifecycle bundle to verify" — when the
true condition is protocol/runtime incompatibility. The user cannot distinguish a
broken release from a release their CLI is simply too old to consume, and the
refusal does not tell them the actionable path (upgrade the CLI).

Source: Multi-Forge v1.3.2-final §21–23 (PR-0B).

Expected outcome

A V2 runtime facing an incompatible future release reports CLI_UPDATE_REQUIRED
with the manual upgrade path, while a broken release that simply publishes no
lifecycle bundle keeps its integrity/publication refusal.

Acceptance criteria

• Characterization of current behavior recorded first: a release document
  consumable by V1/V2 selection rules but carrying no V2-consumable bundle
  currently refuses with UPDATE_INTEGRITY_METADATA_MISSING.
• A V2 runtime detects a future incompatible lifecycle publication (the
  release explicitly declares a lifecycle protocol newer than this runtime's,
  discoverable from release metadata) and refuses with CLI_UPDATE_REQUIRED,
  naming the supported upgrade path.
• A release with no lifecycle bundle and no future-protocol declaration
  remains UPDATE_INTEGRITY_METADATA_MISSING. "Absent bundle" alone must
  never be interpreted as "future protocol".
• Publication gate: the V3 release pipeline verifies
  V3_BRIDGE_RELEASE=<version> — bridge release exists, is published, and
  carries a V2 lifecycle bundle — and blocks the V3 publication otherwise.
• Manual stale-runtime upgrade path documented (an old pre-bridge runtime
  must have a documented, verified escape path).
• The bridge must be merged and shipped in a V2-compatible release before the
  first V3 publication (release choreography).
• Tests: V2 runtime + future-protocol release → CLI_UPDATE_REQUIRED;
  V2 runtime + broken empty release → UPDATE_INTEGRITY_METADATA_MISSING;
  bridge gate blocks when the bridge release is missing.

Out of scope

• ReleaseManifest V3 and the V3 provider contract (PR-4).
• Changing V2 protocol semantics or the V1 compatibility mode.
• Any bidirectional compatibility matrix.

Context

• ainative/lifecycle/provider.py (_select_asset, latest).
• ainative/lifecycle/updater.py (CLI_UPDATE_REQUIRED gate).
• docs/RELEASING.md, scripts/ release gates.
• Depends on nothing. Must ship before the first V3 publication (PR-4 release
  choreography).

Dependencies

• None. Must be merged and shipped in a V2-compatible bridge release before the first V3 publication (PR-4, [Feature] Release V3: source resolver, manifest, GitHub + Local providers (PR-4) #165).