geenforce: gate publishing on the library version, not on the manifest's own

The publish gate exists because a minor version bump that NARROWS behaviour is
not backward compatible: _CmmVersion arrived in lib 2.6, and an older lib does
not know the field, so every gated entry looks unfiltered and it installs every
PC-DMIS version it cannot detect, on every CMM, in one cycle.

It was comparing the fleet's reported library versions against manifestversion.
That is the manifest's own 'Version' field. For a share-imported manifest the
two numbering schemes happen to coincide; for a scope authored in code they do
not, and seed_display_scope writes '2.0' - which every kiosk exceeds. So the
gate passed on the scope that most needed it.

A scope now declares minlibversion. Unset, the requirement is DERIVED from what
the manifest actually uses, so a scope written before this column existed is
still judged on its contents rather than on a number that says nothing about the
library. Only features that narrow behaviour belong in that table; an addition
an old lib ignores harmlessly needs no floor. manifestversion remains the last
fallback, which preserves what share-imported manifests already relied on.

tests/test_plugins/test_geenforce_publish_gate.py

@@ -263,3 +263,42 @@ def test_reported_subtype_keeps_an_unknown_value_verbatim(db):
     stored = ManifestEnforcementReport.query.filter_by(
         hostname='WJKIOSKODD', iscurrent=True).one()
     assert stored.subtype == 'Lobbby'
+
+
+# -- what the gate compares against ------------------------------------------
+#
+# The gate used manifestversion as the library floor. That is the manifest's own
+# 'Version' field: for a share-imported manifest it happens to share the
+# library's numbering, but a code-authored scope sets it freely -
+# seed_display_scope writes '2.0' - so the fleet was compared against a number
+# that says nothing about library features, and the gate passed on the very
+# scope that most needed it.
+
+def test_a_declared_minlibversion_is_what_the_fleet_is_judged_against(db):
+    scope = _scope(manifestversion='2.0')
+    scope.minlibversion = '2.6'
+    db.session.flush()
+    assert service.required_libversion(scope) == '2.6'
+
+    _report('KIOSK01', '2.4')
+    with pytest.raises(service.LibVersionTooOldError):
+        service.publish_scope('gea-shopfloor-cmm', 'runtime')
+
+
+def test_the_floor_is_derived_from_the_features_the_manifest_uses(db):
+    """A scope written before minlibversion existed is still gated on what it
+    contains: a version-gated entry needs lib 2.6, whatever its own Version
+    field claims."""
+    from plugins.geenforce.models import ManifestEntry
+
+    scope = _scope(manifestversion='2.0')
+    scope.entries.append(ManifestEntry(
+        name='PC-DMIS 2023.2', entrytype='MSI', sortorder=0,
+        cmmversion='2023'))
+    db.session.flush()
+    assert service.required_libversion(scope) == '2.6'
+
+
+def test_a_scope_using_nothing_special_falls_back_to_its_own_version(db):
+    scope = _scope(manifestversion='2.4')
+    assert service.required_libversion(scope) == '2.4'