Add repository-wide pinned-tool contract validation and bootstrap support

[randlee]

Problem

Repositories currently duplicate tool installation in workflow YAML, often with floating selectors such as major-only Python, action defaults, or unversioned cargo installs. That makes CI and physical benchmark hosts drift.

ATM is introducing one checked-in contract and a single bootstrap command:

• tools/bootstrap.toml — exact seed, Cargo, Python, and source-revision pins
• tools/bootstrap-requirements.txt — exact Python dependency closure
• tools/bootstrap.py — installs and verifies the contract
• .github/workflows/ci.yml — lint/test lanes invoke just bootstrap

Initial reference contract (atm-core)

• Rust 1.94.1; Python 3.14.4; just 1.58.0
• cargo-deny 0.20.2; cargo-audit 0.22.2; cargo-shear 1.12.0; cargo-modules 0.26.0
• sc-compose source revision 6a8af1ff46ccd64ae9cc40d7d5c815aa9b0a4661
• codespell 2.4.3; maturin 1.14.1; pydantic 2.13.4 and exact transitive closure

The policy is newest stable release compatible with the project seed toolchain, then exact pin. Explicit exceptions are required: cargo-shear 1.13.4 and cargo-modules 0.27.0 each require Rust 1.95, so the newest Rust-1.94.1-compatible releases are pinned.

Requested sc-lint capability

1. Define a reusable repository-owned manifest schema for exact tool versions, Python dependency closures, and Git source revisions.
2. Lint manifests for ranges, major-only selectors, latest/stable aliases, incomplete source revisions, and unpinned tool actions.
3. Verify normal CI lanes call the shared bootstrap contract instead of duplicating installs in YAML.
4. Verify bootstrap installs use exact versions, locked Cargo resolution, isolated Python environments, and post-install version/receipt checks.
5. Provide a report mode that identifies stale pins and toolchain compatibility exceptions, without silently selecting a newer version.
6. Provide a consistent cross-repository command for CI, developer workstations, and dedicated benchmark accounts.

The checker should report source locations in the manifest, scripts, and workflow YAML so repositories can migrate incrementally.

Acceptance criteria

• A repository with a floating tool selector fails lint with a precise diagnostic.
• A repository whose CI bypasses its declared bootstrap path fails lint.
• Exact registry and Git source pins are accepted and independently verifiable.
• A documented, toolchain-incompatible latest release is allowed only with an explicit manifest exception and rationale.
• The tool does not mutate user or CI environments in lint/report mode.