Check every consumer's pin when a release is cut

[sehkone]

Adds one step to Changing a block, after the tag is pushed: check what each consumer is actually carrying.

Why here, when check_drift.py already warns

The warning needs a pull request to appear on. A repository quiet enough for GitHub to have disabled its schedule — sixty days without activity, done silently — is producing none, so the warning waits until somebody starts work there. By then an agent has read that repository's stale AGENTS.md and done a piece of work under it; the signal arrives one step late.

From this side the answer is available for every repository at once, quiet or not, and at the moment somebody is already looking at the roster because they just cut a release. It is the only check that sees a stopped schedule while the repository is still quiet.

The step

latest=$(gh release view --repo aicers/agent-instructions \
           --json tagName --jq .tagName)
roster='import json; print(*json.load(open("repos.json"))["repos"])'
for repo in $(python3 -c "$roster"); do
  pin=$(gh api "repos/aicers/$repo/contents/.agent-instructions.toml" \
          --jq .content | base64 -d \
        | sed -n 's/^ref *= *"\(.*\)"/\1/p')
  [ "$pin" = "$latest" ] || echo "$repo is on $pin"
done

The roster comes from repos.json, so nothing in the README needs editing when a repository is added.

The step also says what a hit means, because most hits are not a problem: every repository is behind for a day or two after a tag, which is the schedule working. What it is looking for is one that stayed behind across releases. Recovery is the dispatch or scripts/sync.sh <tag> <repo> — both already documented, so they are pointed at rather than restated.

Deliberately not here

• Automating it. The upstream GITHUB_TOKEN is scoped to this repository and most consumers are private, so reading their pins from a workflow here needs a cross-repo read token. This repository holds no secrets today, which is what lets it be public and what makes both reusable workflows callable with nothing but the caller's own token. Trading that is a decision for when the manual step has actually been skipped.
• Making check_drift.py fail rather than warn. It covers less than this step does — it cannot fire in a repository that is not producing pull requests — and it would risk turning thirteen repositories red at once, since the workflow and its scripts come from @main.

Verification

• The command was run verbatim as written in the README, against all thirteen repositories: it resolves the roster, reads every pin, and reports none behind (all on 0.3.0).
• markdownlint passes; no line exceeds 80 columns.
• All seven script suites pass, unchanged — nothing outside README.md moves.
• No changelog entry: nothing a consumer of the last release can observe changed, and this cuts no release.

Closes #48