fix: follow official DSH candidates beyond alpha

[WSL043]

The official candidate intake was alpha-only, so it could not advance once DeepSeek Harness moved the 0.1.2 train from alpha to RC.

This change keeps the existing review-only candidate lane but makes candidate selection train-aware:

• considers the bounded npm tags alpha, beta, rc, next, and latest;
• only accepts semver prereleases whose train is alpha, beta, or rc;
• chooses the newest eligible candidate by semver, so 0.1.2-rc.1 correctly outranks 0.1.2-alpha.5;
• ignores stable versions on generic next / latest so the candidate watcher never steals the stable intake's job;
• ignores unrelated prerelease trains such as dev / canary even when a generic tag points at them;
• keeps explicit alpha / beta / rc tags fail-closed if upstream points them at the wrong train;
• still requires verifiable npm integrity plus the matching immutable dsh-v<version> GitHub tag before changing upstream.preview.lock.json;
• retains the existing automation/official-preview branch, manual review, full product qualification, and no-auto-publish/no-auto-merge policy.

Validation:

• regression tests were added for alpha→RC progression, explicit RC tags, stable separation, no downgrade, integrity drift, wrong explicit train, and non-candidate prereleases;
• the full root npm test suite passes;
• a live registry/tag resolution run selected the currently published 0.1.2-rc.1 from npm next, verified its npm integrity, and resolved immutable GitHub tag commit a66e4702047846cdaa10c66c9d3df3951f5ea70d.

No Portable release/version/publishing behavior is changed. This only fixes upstream candidate intake.