feat(v4): allow selected flagged CNR nodepacks

Read nodepack-whitelist.list from the Manager configuration directory to
permit listed Registry IDs case-insensitively without enabling all flagged
installs. Create a commented template when missing and preserve existing files.

Apply the list to both server implementations, deferred version switches,
and scheduled snapshot restores. Document the format and cover admission,
revocation, template initialization, and existing security restrictions.

Pin the code-quality runner to Ubuntu 24.04, which provides Python 3.9 builds.

.github/workflows/ci.yml

@@ -37,7 +37,8 @@ jobs:
 
   code-quality:
     name: Code Quality Checks
-    runs-on: ubuntu-latest
+    # Python 3.9 builds are unavailable for Ubuntu 26.04.
+    runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@v4
       with:
@@ -67,4 +68,4 @@ jobs:
       if: steps.changed-py-files.outputs.any_changed == 'true'
       run: |
         echo "Changed files: ${{ steps.changed-py-files.outputs.all_changed_files }}"
-        echo "${{ steps.changed-py-files.outputs.all_changed_files }}" | xargs -r ruff check
+        echo "${{ steps.changed-py-files.outputs.all_changed_files }}" | xargs -r ruff check