ci(upgrade): support manual runs between any two release versions

The workflow_dispatch inputs already accept arbitrary release tags, but
the run failed late and unclearly when a tag had no .deb asset, and the
from_version default pointed at 1.0.0-rc.4-preview.1, whose release
ships no .deb at all - so scheduled runs died on a 404 while installing
the old package.

- Add a fail-fast preflight that resolves each requested tag via the
  GitHub release API and verifies the rustfs_<tag>_amd64.deb asset
  exists before the suite starts, with an actionable error message
  otherwise (e.g. 1.0.0-rc.4 ships only zip/sbom assets).
- Change the from_version default to 1.0.0-rc.3, the newest release
  that actually ships a .deb asset.
- Reword the from_version/to_version descriptions so manual triggers
  state the .deb-asset requirement and the nightly fallback.
- Pass PF_TESTING_GH_TOKEN as GH_TOKEN to the suite step for the gh api
  release lookups, matching the other functional workflows.

.github/workflows/rustfs-upgrade-test.yml

@@ -18,15 +18,15 @@ on:
   workflow_dispatch:
     inputs:
       from_version:
-        description: 'OLD RustFS release tag (e.g. 1.0.0-rc.4-preview.1)'
+        description: 'OLD RustFS release tag, e.g. 1.0.0-rc.3 (its release must ship a .deb asset). Leave empty for the default.'
         required: false
-        default: '1.0.0-rc.4-preview.1'
+        default: '1.0.0-rc.3'
       from_url:
         description: 'OLD .deb URL. Overrides from_version.'
         required: false
         type: string
       to_version:
-        description: 'NEW RustFS release tag (leave empty for latest nightly)'
+        description: 'NEW RustFS release tag, e.g. 1.0.0-rc.5 (any version with a .deb asset). Leave empty for latest nightly.'
         required: false
       to_url:
         description: 'NEW .deb URL. Overrides to_version / nightly default.'
@@ -145,6 +145,7 @@ jobs:
         continue-on-error: true
         env:
           LOG_FILE: /tmp/rustfs-upgrade.log
+          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
         run: |
           set -euo pipefail
           chmod +x auto-testing/rustfs-upgrade-test.sh
@@ -175,6 +176,29 @@ jobs:
           else
             ARGS+=(--to-url "${RUSTFS_NIGHTLY_PACKAGE_URL}")
           fi
+          # Fail fast with a clear message when a requested release tag has
+          # no .deb asset (e.g. 1.0.0-rc.4 ships only zips), instead of
+          # letting the suite die mid-run on a 404.
+          check_release_asset() {
+            local version="$1" tag asset url
+            [ -n "${version}" ] && [ "${version}" != "null" ] || return 0
+            tag="${version#v}"
+            asset="rustfs_${tag//-/.}_amd64.deb"
+            url="https://github.com/rustfs/rustfs/releases/download/${tag}/${asset}"
+            if ! gh api "repos/rustfs/rustfs/releases/tags/${tag}" --jq '.assets[].name' 2>/dev/null | grep -qxF "${asset}"; then
+              echo "ERROR: release ${tag} has no downloadable asset ${asset}:" >&2
+              echo "       ${url}" >&2
+              echo "Pick a tag whose release ships a .deb (check its release assets)." >&2
+              exit 1
+            fi
+            echo "resolved ${tag} -> ${url}"
+          }
+          if [ -z "${FROM_URL}" ]; then
+            check_release_asset "${FROM_VERSION}"
+          fi
+          if [ -z "${TO_URL}" ]; then
+            check_release_asset "${TO_VERSION}"
+          fi
           ./auto-testing/rustfs-upgrade-test.sh "${ARGS[@]}"
 
       - name: Generate report