This is required for consumers of managed services on Azure to be able to ugprade their HO in a controlled fashion.

The total matrix here is enormous, but rather than check everything we can check three things

1. every supported CPO latest 4.y.z 
2. every supported CPO latest-minus-one 4.y.z version
3. every supported minor release 4.y.0

We need the 4.y.z and the latest-minus-one to ensure that every level of HO has a plausible way to migrate CPOs up to a compatible level.  This compatibility is the bare minimum that makes upgrades possible for consumers.

Additional compatibility is (currently) up to consumers, but if there are enough on-prem failures that may need to be reconsidered.