snapshot: replace the alternate-media guard with a version-comparison ("do not downgrade the alternate") check

[shigechika]

Follow-up to #107 / #108 (the standalone snapshot subcommand).

Problem with the current guard

snapshot.create_snapshot() ships a best-effort safety guard,
running_on_alternate_media(dev), that probes show system snapshot for
"running on alternate media"-type markers and refuses (unless --force) when it
thinks the device booted from its backup media.

Two issues with that approach:

1. Wrong detection source. The "running on alternate media device" string is
   a login / boot-time NOTICE banner, not part of show system snapshot output.
   So on the primary target (fixed-config MX) the probe will not find the marker
   and the detector returns False — i.e. the guard effectively never fires on
   the platform it most needs to protect. (It is fail-safe — it never false-
   refuses — but it also does not actually protect yet.)

2. Wrong axis. "Refuse if running on the alternate media" is not the real
   safety property. A real in-place recovery demonstrated the gap: a box was
   booted from its alternate slot, a fresh/newest JUNOS was installed onto that
   slot, and the correct next step was to snapshot from that (alternate) slot
   onto the primary. The current guard would have blocked that legitimate,
   desirable snapshot. The actual risk is not "which slot am I on" — it is
   propagating an older system over a newer one (cloning a stale/"fossil"
   image onto a target that is more current).

Proposed redesign: version-comparison guard ("don't downgrade the alternate")

Refuse (unless --force) only when the snapshot would downgrade the target
(alternate) media — i.e. when the running version is older than the version
already on the alternate. That is the precise fossil-propagation hazard.

• Read the JUNOS version on the target/alternate media and compare with the
  running version (dev.facts["version"]), using the existing
  looseversion-based comparison already in upgrade.py.
• Refuse when running < alternate (would downgrade); proceed when
  running >= alternate; --force overrides; inconclusive (cannot read the
  alternate version) → proceed with a warning (keep the fail-safe behaviour).
• Drop the show system snapshot banner-string heuristic (or keep it only as a
  secondary, clearly-labelled hint).

Shared mechanism with snapshot-audit

Reading the alternate-media version is exactly what the planned snapshot-audit
follow-up needs (fleet-wide primary-vs-alternate drift). Implement the
alternate-version read once and share it. Note fixed-config MX rejects
show system snapshot media, so the read likely needs another path (e.g.
mounting the alternate root and reading /<altroot>/packages/jbase-*); this
needs field verification on hardware.

Acceptance criteria

• Snapshot is refused (clear message, non-zero, --force overrides) only when it
  would downgrade the alternate media (running version < alternate version).
• Legitimate "newest image is on the slot I booted from" snapshots are allowed.
• Alternate-version read works on (or degrades gracefully for) fixed-config MX,
  EX (SWITCH), and SRX_BRANCH; shared with snapshot-audit.
• Tests cover: downgrade → refuse, same/upgrade → proceed, --force override,
  unreadable alternate version → proceed-with-warning.