ci: pin habit-hooks and its plugin to 1.5.0

[CMaintz]

CI was doing a bare pip install habit-hooks <plugin>, so every run grabbed whatever was latest on PyPI. That breaks the pin-everything rule in CONTRACT.md and means a habit-hooks release could turn a gate red with no change on my side.

• New habit_hooks_version input (default 1.5.0, current latest) on _ts, _java, _php, _dotnet, bootstrap, and passed through from the gate.yml facade.
• Core and plugin are both pinned to it (habit-hooks==X + <plugin>==X). The plugins release in lockstep with the core, so one version covers both.
• Inputs go through env: now instead of being interpolated straight into the shell.
• Added a Renovate regex manager (pypi datasource) using the same pattern as the mise/PMD/osv-scanner pins, so it gets bumped.

Checked locally: actionlint clean, renovate-config-validator passes, and the regex hits all six defaults.