Upgrade compat matrix

Allow / deny rules per (from → to) release pair. Empty matrix falls back to default policy: same ceph release allowed; different release requires an explicit allow rule. Sentinel pre-flight re-validates these locally, so they're defense-in-depth.