Release recalls

You can now recall a bad release, or a whole range of versions, for a service with a recorded reason, and Ryvn stops rolling it out. Auto-upgrades on release channels skip recalled versions, promotion pipelines won't advance them, and queued upgrades or promotions to them are canceled. Installations already running a recalled version stay where they are, so you can ship the fix forward instead of being forced into a rollback.