Treat a Model Upgrade Like a Schema Migration

The most common LLMOps incident I've seen is not a prompt bug or a jailbreak. It's a one-line diff.