fix(toolchain): package Zig requirement

[GenericJam]

Summary

• keep the exact Zig requirement in shipped MobDev source instead of compile-time reading a repository-only dotfile
• enforce exact lockstep with the root toolchain pin in source tests
• unpack the real Hex artifact, compile it fresh without a packaged .tool-versions file, and probe doctor/native exact, mismatch, and failed-command behavior

Validation

• full suite: 2162 passed, 10 excluded
• packed Hex compile and runtime preflight regression
• format, warnings-as-errors compile, strict Credo, erlfmt, and pre-push checks
• local-only security scan: zero source findings; strict exit remains from six pre-existing cached-runtime manifest-drift findings

Bead: app-840

[GenericJam]

Reviewed: inlining the pin into packaged source with a lockstep test against root .tool-versions is the right call for a lib package (no priv indirection needed), and the packed-artifact regression (fetch layout, confirm dotfile absent, fresh compile + doctor/native probes) permanently covers the failure mode 0.6.29 shipped with. Merging and cutting 0.6.30.