Fix version paradox in package upgrade/downgrade tests

Prevent testing upgrades from newer releases to older dev branches by
only including testing releases that are older than the current version.

This fixes the issue where after a new release (e.g., v3007.10), branches
based on older versions (e.g., v3007.9+dev) would try to upgrade FROM
the newer release TO the older dev version, which is backwards and causes
all upgrade/downgrade package tests to fail.

The fix ensures that only versions older than the current branch are used
as testing releases for upgrade/downgrade tests.

Example:
- Current branch: v3007.9-653-gabcd1234 (based on 3007.9 + dev commits)
- Latest 3007.x tag: v3007.10 (newer release)
- Before: Would try to upgrade FROM 3007.10 TO 3007.9+dev (backwards!)
- After: Skips 3007.10, uses 3007.9 or earlier versions instead

This eliminates the need to wait for release tags to be "merged forward"
before package tests can pass on development branches.

Author: dwoz

tools/ci.py

@@ -342,10 +342,14 @@ def get_testing_releases(
         )
     )[-num_major_versions:]
     testing_releases = []
-    # Append the latest minor for each major
+    # Append the latest minor for each major that is older than the current version
     for major in majors:
         minors_of_major = [version for version in releases if version.major == major]
-        testing_releases.append(minors_of_major[-1])
+        latest_minor = minors_of_major[-1]
+        # Only include versions older than current to prevent version paradox
+        # (e.g., don't test upgrading FROM 3007.10 TO 3007.9+dev)
+        if latest_minor < parsed_salt_version:
+            testing_releases.append(latest_minor)
 
     str_releases = [str(version) for version in testing_releases]
 
@@ -910,10 +914,14 @@ def workflow_config(
         )
     )[-num_major_versions:]
     testing_releases = []
-    # Append the latest minor for each major
+    # Append the latest minor for each major that is older than the current version
     for major in majors:
         minors_of_major = [version for version in releases if version.major == major]
-        testing_releases.append(minors_of_major[-1])
+        latest_minor = minors_of_major[-1]
+        # Only include versions older than current to prevent version paradox
+        # (e.g., don't test upgrading FROM 3007.10 TO 3007.9+dev)
+        if latest_minor < parsed_salt_version:
+            testing_releases.append(latest_minor)
     str_releases = [str(version) for version in testing_releases]
     ctx.info(f"str_releases {str_releases}")