playbooks/upgrade-docker-ce: accept compose plugin major ≥ 2 (was hardcoded v2.X.Y)

docker-ce 29 ships docker-compose-plugin renumbered to v5.x (was v2.x
with docker-ce 26-28). Same Compose v2 codebase under the hood —
Docker just realigned the major number. The verify regex was hardcoded
to `v2\.[0-9]+\.[0-9]+`, so a successful migration on esh-docker-vm
(29.4.1, 16/16 stacks back up clean) reported FAILED on the verify
phase. Switched to `docker compose version --short` parsed for major,
gated `>= 2` — works across future plugin renumbers too.

STATUS.md: mark esh-docker-vm done. ana-docker is the last host.

STATUS.md

@@ -338,8 +338,14 @@ Order (least → most blast radius):
      homepage-discovery binding) → "conflicting host options".
    Playbook now backs up any existing override, probes `daemon.json`
    for `hosts:`, and installs an override that strips `-H` when needed.
-2. **esh-docker-vm** — pending. Run from your TTY:
+2. ~~**esh-docker-vm**~~ — **done 2026-04-24.** docker-ce 29.4.1, all
-   `scripts/elway esh-docker-vm --playbook playbooks/upgrade-docker-ce.yaml`
+   16 stacks back up clean (adguard, beszel-agent, calibre-web,
+   cloudflare-ddns, dockge, dozzle-agent, drawio, esphome, homeassistant,
+   homepage, mosquitto, paperless-ngx, pgadmin, traefik, uptimekuma).
+   Surfaced one verify-only nit: the docker-compose-plugin shipped with
+   docker-ce 29 is renumbered v5.x (was v2.x with 26-28); same Compose
+   v2 codebase, just realigned major. Playbook's compose-version verify
+   was hardcoded to `v2.X.Y` and false-failed — now accepts any major ≥ 2.
 3. **ana-docker** — pending. Largest blast radius (homepage, miniflux,
    news-digest, synapse, seafile, vaultwarden, gitea, openwebui, …).
    Verify each card / service after.

playbooks/upgrade-docker-ce.yaml

@@ -224,8 +224,15 @@ verify:
       [ "$v" -ge 24 ]
     changed_when: "false"
 
-  - name: docker compose plugin v2 installed
+  - name: docker compose plugin v2+ installed
-    shell: docker compose version | grep -qE 'v2\.[0-9]+\.[0-9]+'
+    # docker-ce 29 ships docker-compose-plugin renumbered to v5.x (was
+    # v2.x with docker-ce 26-28). Both are the same Compose v2 codebase
+    # under the hood — Docker just realigned the plugin's major number.
+    # Accept anything ≥ 2 so this verify keeps working across future
+    # plugin renumbers.
+    shell: |
+      major=$(docker compose version --short | sed 's/^v//' | cut -d. -f1)
+      [ "$major" -ge 2 ]
     changed_when: "false"
 
   - name: at least one previously-running stack is back up