playbooks/upgrade-docker-ce: accept compose plugin major ≥ 2 (was hardcoded v2.X.Y)

docker-ce 29 ships docker-compose-plugin renumbered to v5.x (was v2.x
with docker-ce 26-28). Same Compose v2 codebase under the hood —
Docker just realigned the major number. The verify regex was hardcoded
to `v2\.[0-9]+\.[0-9]+`, so a successful migration on esh-docker-vm
(29.4.1, 16/16 stacks back up clean) reported FAILED on the verify
phase. Switched to `docker compose version --short` parsed for major,
gated `>= 2` — works across future plugin renumbers too.

STATUS.md: mark esh-docker-vm done. ana-docker is the last host.

playbooks/upgrade-docker-ce.yaml

@@ -224,8 +224,15 @@ verify:
       [ "$v" -ge 24 ]
     changed_when: "false"
 
-  - name: docker compose plugin v2 installed
-    shell: docker compose version | grep -qE 'v2\.[0-9]+\.[0-9]+'
+  - name: docker compose plugin v2+ installed
+    # docker-ce 29 ships docker-compose-plugin renumbered to v5.x (was
+    # v2.x with docker-ce 26-28). Both are the same Compose v2 codebase
+    # under the hood — Docker just realigned the plugin's major number.
+    # Accept anything ≥ 2 so this verify keeps working across future
+    # plugin renumbers.
+    shell: |
+      major=$(docker compose version --short | sed 's/^v//' | cut -d. -f1)
+      [ "$major" -ge 2 ]
     changed_when: "false"
 
   - name: at least one previously-running stack is back up