fix(setup): guard known affected ublk kernels

[catyans]

Summary

• fail fast before ublk provisioning or runtime checks on kernel releases known
  to contain the ADD_DEV initialization regression
• cover upstream 6.18.4/6.18.5 release variants and the affected Ubuntu Azure
  releases recorded in AgentENV fails on kernels affected by the ublk ADD_DEV initialization regression #20
• provide an explicit override for vendor kernels with a verified backport of
  prerequisite commit 011af85ccd87
• document the upgrade path, override, and why probing ADD_DEV is unsafe

Why

On an affected kernel, the first UBLK_U_CMD_ADD_DEV can hang and trigger a
kernel NULL-pointer dereference. Waiting for device creation to fail is
therefore not a safe compatibility probe.

This change checks the running release before AgentENV enters the ublk path and
returns an actionable error. The guard is intentionally limited to releases
known to be affected. Operators whose vendor kernel has backported the
prerequisite fix can set:

AENV_ALLOW_KNOWN_AFFECTED_UBLK_KERNEL=1

The override emits a warning and only bypasses the release check; it does not
claim to work around the kernel defect.

Validation

• Lingjun cluster (5.10.134-16.3.al8.x86_64):
  • cargo fmt --all -- --check
  • cargo test -p agentenv setup::ublk::tests -- --nocapture (3 passed)
  • mdBook 0.5.4 static-musl build
• current-commit AENV CI passed:
  • cargo fmt --all -- --check
  • clippy
  • unit tests
• detector tests cover upstream, distro-suffixed, fixed, adjacent, and
  false-positive release strings
• override parsing tests require an explicit 1 or true
• mdBook 0.5.4 build passed
• git diff --check

Closes #20.

[github-actions]

✅ OpenCodeReview: No comments generated. Looks good to me.

[catyans]

Addressed the latest suffix-matching review and completed an independent Linux validation on head e65b73f:

• cargo fmt --all -- --check ✅
• cargo test -p agentenv setup::ublk::tests -- --nocapture ✅ (3 passed, 0 failed)

The targeted cases include Azure kernel releases with -custom / +debug suffixes as affected, while near-prefix strings without a valid delimiter remain unaffected.