direct: Warn when state was written by a newer CLI version

[denik]

Stacked on #6222, which makes cli_version record the CLI that last wrote the state — without that this
warning reads a value that can be many releases stale.

Why

resources.json records the CLI version that last wrote it, but nothing looks at it. Deploying with
an older CLI than the one that wrote the state is allowed, but it is usually unintended, so warn about
it. The state_version field remains the hard gate — dstate.Open rejects a schema it cannot read.

Tests

Acceptance test with a committed resources.json fixture recording cli_version 99.0.0, since the
running version is only known at test time. The negative case derives cli_version from
$CLI version and asserts silence. Unit test on the comparison covers dev builds, prereleases and
malformed versions.

[github-actions]

Approval status: pending

/acceptance/bundle/ - needs approval

6 files changed
Suggested: @janniklasrose
Also eligible: @shreyas-goenka, @andrewnester, @pietern, @lennartkats-db, @anton-107

/bundle/ - needs approval

Files: bundle/direct/dstate/state.go
Suggested: @janniklasrose
Also eligible: @shreyas-goenka, @andrewnester, @pietern, @lennartkats-db, @anton-107

/cmd/bundle/ - needs approval

Files: cmd/bundle/utils/process.go, cmd/bundle/utils/process_test.go
Suggested: @janniklasrose
Also eligible: @shreyas-goenka, @andrewnester, @pietern, @lennartkats-db, @anton-107

General files (require maintainer)

Files: .nextchanges/bundles/state-newer-cli-version-warning.md
Based on git history:

• @janniklasrose -- recent work in .nextchanges/bundles/, bundle/direct/dstate/, cmd/bundle/utils/

_{Any maintainer (@andrewnester, @anton-107, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db, @janniklasrose, @lennartkats-db, @rugpanov, @rclarey) can approve all areas.
See OWNERS for ownership rules.}

[eng-dev-ecosystem-bot]

Integration test report

Commit: 855f637

Run: 31491966098

	Env	❌​FAIL	🟨​KNOWN	🔄​flaky	💚​RECOVERED	🙈​SKIP	✅​pass	🙈​skip	Time
❌​	aws linux	1	1		3	4	294	1131	8:13
❌​	aws windows	1	1		3	4	296	1129	8:15
❌​	azure linux	1	1		3	4	293	1131	9:09
❌​	azure windows	1	1		3	4	295	1129	9:06
❌​	gcp linux	1	1	1		5	293	1131	9:01
❌​	gcp windows	1	1			5	296	1129	9:26

10 interesting tests: 4 SKIP, 3 RECOVERED, 1 KNOWN, 1 FAIL, 1 flaky

	Test Name	aws linux	aws windows	azure linux	azure windows	gcp linux	gcp windows
🟨​	TestAccept	🟨​K	🟨​K	🟨​K	🟨​K	🟨​K	🟨​K
🙈​	TestAccept/bundle/invariant/no_drift	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_endpoints/drift/recreated_same_name	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_indexes/recreate/embedding_dimension	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
❌​	TestAccept/pipelines/destroy/cascade-on-destroy-terraform-error	❌​F	❌​F	❌​F	❌​F	❌​F	❌​F
🙈​	TestAccept/ssh/connection	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🔄​	TestSyncNestedFolderDoesntFailOnNonEmptyDirectory	✅​p	✅​p	✅​p	✅​p	🔄​f	✅​p
💚​	TestFetchRepositoryInfoAPI_FromRepo	💚​R	💚​R	💚​R	💚​R	🙈​S	🙈​S
💚​	TestFetchRepositoryInfoAPI_FromRepo/root	💚​R	💚​R	💚​R	💚​R
💚​	TestFetchRepositoryInfoAPI_FromRepo/subdir	💚​R	💚​R	💚​R	💚​R

Top 1 slowest tests (at least 2 minutes):

duration	env	testname
3:18	aws windows	TestFilerRecursiveDelete/workspace_files_extensions