geenforce: gate publishing on the library version, not on the manifest's own

The publish gate exists because a minor version bump that NARROWS behaviour is
not backward compatible: _CmmVersion arrived in lib 2.6, and an older lib does
not know the field, so every gated entry looks unfiltered and it installs every
PC-DMIS version it cannot detect, on every CMM, in one cycle.

It was comparing the fleet's reported library versions against manifestversion.
That is the manifest's own 'Version' field. For a share-imported manifest the
two numbering schemes happen to coincide; for a scope authored in code they do
not, and seed_display_scope writes '2.0' - which every kiosk exceeds. So the
gate passed on the scope that most needed it.

A scope now declares minlibversion. Unset, the requirement is DERIVED from what
the manifest actually uses, so a scope written before this column existed is
still judged on its contents rather than on a number that says nothing about the
library. Only features that narrow behaviour belong in that table; an addition
an old lib ignores harmlessly needs no floor. manifestversion remains the last
fallback, which preserves what share-imported manifests already relied on.

plugins/geenforce/models/manifest.py

@@ -49,6 +49,15 @@ class ManifestScope(BaseModel):
     computertypeid = db.Column(db.Integer, nullable=True)
     measuringtooltypeid = db.Column(db.Integer, nullable=True)
     manifestversion = db.Column(db.String(16), nullable=False, default='1.0')
+    # Lowest GE-Enforce client library that may enforce this scope, e.g. '2.6'.
+    #
+    # SEPARATE FROM manifestversion, which is the manifest's own 'Version' field
+    # and is whatever its author wrote - seed_display_scope picks '2.0'. The
+    # publish gate used manifestversion as the library floor, so for every
+    # code-authored scope it compared the fleet against a number that says
+    # nothing about library features, and passed. NULL means "derive it", see
+    # service.required_libversion.
+    minlibversion = db.Column(db.String(16), nullable=True)
     description = db.Column(db.String(255), nullable=True)
     # The manifest-level '_comment' (documentation), preserved verbatim so
     # export-to-share round-trips it. Excluded from behavioral parity.