[9.2] [Fleet] only auto-install content packages newer than the installed version (#262703)

## Summary

Backport of #262509 to 9.2.

The auto-install content packages task was using string equality (`!==
version`) to decide whether to reinstall a package. This meant any
version mismatch would trigger a reinstall, effectively downgrading
packages.

The fix replaces string equality with `semverGt` to ensure a package is
only installed when the registry version is strictly newer than the
installed version.

<!--BACKPORT [{"author":{"name":"Julia
Bardi","email":"90178898+juliaElastic@users.noreply.github.com"},"sourceCommit":{"committedDate":"2026-04-10T14:55:34Z","message":"[Fleet]
only auto-install content packages newer than the installed version
(#262509)","sha":"3f939ce873bcbba27b7ccfd44093aa2198bcc743"},"sourcePullRequest":{"number":262509,"url":"https://github.com/elastic/kibana/pull/262509"},"sourceBranch":"main","suggestedTargetBranches":["9.2"],"targetPullRequestStates":[{"branch":"9.2","label":"v9.2.9","state":"NOT_CREATED"}]}]
BACKPORT-->

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: juliaElastic

x-pack/platform/plugins/shared/fleet/server/tasks/auto_install_content_packages_task.test.ts

@@ -249,5 +249,56 @@ describe('AutoInstallContentPackagesTask', () => {
       expect(packageClientMock.installPackage).not.toHaveBeenCalled();
       expect(dataStreamService.getAllFleetDataStreams).not.toHaveBeenCalled();
     });
+
+    it('should not downgrade package when a newer prerelease version is installed', async () => {
+      // Registry has 1.1.0, but a prerelease 2.0.0-preview is already installed.
+      // The task must not downgrade to 1.1.0.
+      mockGetInstalledPackages.mockResolvedValue({
+        items: [
+          {
+            name: 'kubernetes_otel',
+            version: '2.0.0-preview',
+          },
+          {
+            name: 'test_package',
+            version: '2.0.0-preview',
+          },
+        ],
+      });
+
+      await runTask();
+
+      expect(packageClientMock.installPackage).not.toHaveBeenCalled();
+    });
+
+    it('should not downgrade one package while upgrading another', async () => {
+      // kubernetes_otel has a prerelease installed (must not downgrade),
+      // test_package has an older version installed (must upgrade).
+      mockGetInstalledPackages.mockResolvedValue({
+        items: [
+          {
+            name: 'kubernetes_otel',
+            version: '2.0.0-preview',
+          },
+          {
+            name: 'test_package',
+            version: '1.0.0',
+          },
+        ],
+      });
+
+      await runTask();
+
+      expect(packageClientMock.installPackage).toHaveBeenCalledTimes(1);
+      expect(packageClientMock.installPackage).toHaveBeenCalledWith({
+        pkgName: 'test_package',
+        pkgVersion: '1.1.0',
+        useStreaming: true,
+        automaticInstall: true,
+      });
+      expect(packageClientMock.installPackage).not.toHaveBeenCalledWith(
+        expect.objectContaining({ pkgName: 'kubernetes_otel' })
+      );
+    });
   });
 });

x-pack/platform/plugins/shared/fleet/server/tasks/auto_install_content_packages_task.ts

@@ -5,6 +5,7 @@
  * 2.0.
  */
 import pMap from 'p-map';
+import semverGt from 'semver/functions/gt';
 import {
   type CoreSetup,
   type ElasticsearchClient,
@@ -239,7 +240,8 @@ export class AutoInstallContentPackagesTask {
       this.discoveryMap!
     ).reduce((acc, [dataset, mapValue]) => {
       const packages = mapValue.packages.filter(
-        (pkg) => !installedPackagesMap[pkg.name] || installedPackagesMap[pkg.name] !== pkg.version
+        (pkg) =>
+          !installedPackagesMap[pkg.name] || semverGt(pkg.version, installedPackagesMap[pkg.name])
       );
       if (packages.length > 0) {
         acc[dataset] = { packages };
@@ -256,7 +258,8 @@ export class AutoInstallContentPackagesTask {
         if (
           mapValue.packages.every(
             (pkg) =>
-              installedPackagesMap[pkg.name] && installedPackagesMap[pkg.name] === pkg.version
+              installedPackagesMap[pkg.name] &&
+              !semverGt(pkg.version, installedPackagesMap[pkg.name])
           )
         ) {
           acc.push(dataset);
@@ -280,7 +283,7 @@ export class AutoInstallContentPackagesTask {
 
       if (hasData) {
         for (const { name, version } of packages) {
-          if (!installedPackagesMap[name] || installedPackagesMap[name] !== version) {
+          if (!installedPackagesMap[name] || semverGt(version, installedPackagesMap[name])) {
             packagesToInstall[name] = version;
           }
         }