Admin Canary Set Version

Set the canary version for a platform. Refuse a version that is not strictly higher than the line's current maximum — the same publication-order bar admin_publish_version enforces (never offer a build the fleet already passed). windows is allowed as of #108 PR3: get_runtime_latest now excludes the win-% canary from the public serve and hands it only to a listed machine, so a set no longer leaks the row to the fleet. line_query(version_line(...)) compares a win-% set against the win-% line, a darwin set against the darwin line.