PreviousMinor cannot resolve a source for a target whose minor is zero. This leaves stable major-boundary upgrade verification without a source; openshift/release#86279 removed the affected check from 5-scos-stable. The public OKD 5.0 release notes explicitly describe upgrades from 4.22, and the 5.0.0-okd-scos.1 release metadata lists 4.22.0-okd-scos.10 as an upgrade source.

Add an opt-in previousMinorOverride for verification jobs and release periodics using PreviousMinor. It specifies a target major.minor, an exact stable stream name, and a source major.minor. For a matching target, choose the highest accepted matching semantic version from that stream in the target's namespace. Patch and prerelease identifiers do not affect target matching. For example, a policy for target 5.0, stream 4-scos-stable, and source 4.22 applies to every 5.0.x payload; 5.1+ retains normal previous-minor selection. There are no OKD-specific constants in the selection logic.

Missing eligible sources return an error rather than a successful no-op, so a blocking verification cannot accept a matching target without an upgrade source. Runtime and offline configuration validation reject malformed or conflicting policies. Existing acceptance-phase handling, including ReleasePayload condition precedence, is reused. Namespace filtering prevents an architecture-specific target from taking a source from another architecture namespace. Existing job optional/async settings and streams without the policy retain their behavior.

This PR adds controller support and documentation only. Activation requires a subsequent openshift/release configuration change after the updated controller is deployed. That configuration is prepared locally, with a blocking amd64 check from accepted 4.22 sources; no release-config PR is included. The existing AWS Prow job consumes controller-supplied initial/latest image overrides and requires no hardcoded source changes. Current arm64 stable streams have no verification jobs and remain unchanged.

Validation:

• go test ./...
• make verify (formatting, vet, Go-version and generated-CRD checks)
• make verify-codegen-script
• make verify-codegen-crds
• go fix -diff ./... (no changes proposed)
• golangci-lint run --timeout=20m using version 2.10.1 from the configured CI image
• Built the controller and validated the complete current openshift/release release-config tree, including the locally prepared policy
• Ran the release-controller configuration generator and hack/validate-release-controller-config.sh in the release worktree; no generated-file changes
• Reviewed the full diff and checked whitespace

Tests cover initial and later 5.0 payloads, 5.0 patches/prereleases, ordinary 5.1 selection, unrelated streams without opt-in, exact source-stream/minor restrictions, missing/non-accepted/non-stable sources, missing pull specs, ReleasePayload phase precedence, architecture namespace isolation, periodics, and runtime/offline policy validation. Cluster end-to-end upgrade jobs were not run locally.

Summary by CodeRabbit

• New Features
  • Verification jobs and release periodics can now select a stable source release for previous-minor upgrades when the target major.minor matches the configured version.
  • Source selection requires an eligible accepted release in the specified stable stream and target namespace; missing or invalid sources produce errors.
• Bug Fixes
  • Invalid override settings are now reported during configuration validation.
• Documentation
  • Added guidance on configuring target-scoped previous-minor source policies, eligibility rules, and error handling.