Docs: SPEC §11 — add `appctl prod upgrade` row to the command table

Documents the new subcommand alongside `prod start` / `dev start` /
`check`. The cell covers VER resolution (default `latest`, virtual
`test` ⇒ origin/main HEAD), the stop → fetch → checkout → build →
start flow, the manual `latest` bump command, and the dirty-tree
prompt.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

SPEC.md

@@ -1686,6 +1686,7 @@ invocations. Pick the one that matches what you're doing:
 | Goal | Command | What runs |
 |---|---|---|
 | Run prod build (or operate it) | `./appctl prod start` | `docker-compose.yml` only — the `runtime` image with baked CSS |
+| Pin a prod box to a release | `./appctl prod upgrade [VER]` | Stop → `git fetch --tags origin` → `git checkout --detach <ref>` → rebuild → start. `VER` defaults to the `latest` tag (manually pointed at the current release; bump locally with `git tag -f latest vX.Y.Z`). `test` is a virtual keyword that resolves to `origin/main` HEAD after fetch. Warns + prompts before proceeding on a dirty working tree |
 | Iterate on code locally | `./appctl dev start` | `docker-compose.yml` + `docker-compose.dev.yml` — adds source bind mounts, `APP_ENV=development`, and a `css-watcher` sidecar that runs `tailwindcss --watch` against the host |
 | Lint + tests, one-shot | `./appctl check` | Builds the `tests` Dockerfile target on demand and runs `php -l` + PHPUnit in a `--rm` container; doesn't require the dev stack to be running |