fix: enforce the zizmor guardrail version

[randomparity]

Summary

• install an exact zizmor and uv version in CI
• reject local zizmor versions that differ from the admitted version
• cover admitted, older, newer, malformed, and failed version output
• record the version contract and its rollback constraints

Verification

• just verify
• managed pre-push verification
• adversarial review: approved after two passes
• security review: approved with no findings

Closes #259

[randomparity]

verdict: approve
exit: none
findings: 0
iterations: 2
security: approve
delivered-head-sha: 938db37

Forge whole-branch review

forge review: not required (plan tasks were tightly coupled, so cast mode implemented them directly with focused tests and full guardrails)