Read-only. The app variants' provisioner version gate
(docs/app-variants.md, 5a), with the values POST /runs applies, so
the run dialog and the notebook wizard can disable compute nodes
that would be refused. The server's check stays authoritative.

variants.minProvisionerVersion is returned as configured:

• a release version (v1.26.0): a step on a non-default variant
  needs a node whose provisionerImageTag is at least that;
• empty: the gate is off;
• any other value (the TBD-PROV-1 placeholder until the
  provisioner release with variants is known): the gate is on but
  not configured, so every node with a release tag is refused.

variants.allowUnversionedProvisioner: nodes whose provisioner tag
isn't a release version (latest, a sha, none) may run non-default
variants (dev); otherwise they are refused while the gate is on.