playbooks/upgrade-docker-ce: accept compose plugin major ≥ 2 (was hardcoded v2.X.Y)

docker-ce 29 ships docker-compose-plugin renumbered to v5.x (was v2.x
with docker-ce 26-28). Same Compose v2 codebase under the hood —
Docker just realigned the major number. The verify regex was hardcoded
to `v2\.[0-9]+\.[0-9]+`, so a successful migration on esh-docker-vm
(29.4.1, 16/16 stacks back up clean) reported FAILED on the verify
phase. Switched to `docker compose version --short` parsed for major,
gated `>= 2` — works across future plugin renumbers too.

STATUS.md: mark esh-docker-vm done. ana-docker is the last host.

STATUS.md

@@ -338,8 +338,14 @@ Order (least → most blast radius):
      homepage-discovery binding) → "conflicting host options".
    Playbook now backs up any existing override, probes `daemon.json`
    for `hosts:`, and installs an override that strips `-H` when needed.
-2. **esh-docker-vm** — pending. Run from your TTY:
-   `scripts/elway esh-docker-vm --playbook playbooks/upgrade-docker-ce.yaml`
+2. ~~**esh-docker-vm**~~ — **done 2026-04-24.** docker-ce 29.4.1, all
+   16 stacks back up clean (adguard, beszel-agent, calibre-web,
+   cloudflare-ddns, dockge, dozzle-agent, drawio, esphome, homeassistant,
+   homepage, mosquitto, paperless-ngx, pgadmin, traefik, uptimekuma).
+   Surfaced one verify-only nit: the docker-compose-plugin shipped with
+   docker-ce 29 is renumbered v5.x (was v2.x with 26-28); same Compose
+   v2 codebase, just realigned major. Playbook's compose-version verify
+   was hardcoded to `v2.X.Y` and false-failed — now accepts any major ≥ 2.
 3. **ana-docker** — pending. Largest blast radius (homepage, miniflux,
    news-digest, synapse, seafile, vaultwarden, gitea, openwebui, …).
    Verify each card / service after.