ci(wave3): stub-sentinel detection step in tier3-container matrix

[hyperpolymath]

Summary

Second half of #75 — the per-prover smoke-check step in the weekly Tier-3 container build uses `|| true` for backends whose CLIs exit non-zero on quit (metamath/hol4/acl2/etc.). That was correct for the per-backend version-check intent, but it also silently swallowed the case where a graceful stub fallback (defined in `Containerfile.wave3` for tamarin/proverif/scip/metamath) printed its sentinel and exited 1. Result: a broken upstream pin masquerading as a passing weekly build — exactly the regression #75 was filed to surface.

This adds a new step (`Stub-sentinel detection (#75)`) that re-runs each matrix cell's `version_check`, captures stdout+stderr verbatim, and fails LOUDLY with a `::error::` annotation on any of:

Pattern	Source backend
`not available (bundle install failed`	tamarin, scip
`not available (build failed`	metamath
`not available (source build failed`	proverif
`bundle install failed at image build time`	generic
`build failed at image build time`	generic
`source build failed at image build`	generic

Out of scope (by design)

• Imandra is not matched — its stub says "proprietary licence required" rather than the build-time sentinels, and it's excluded from the matrix anyway (not licensable in public CI).
• Hard-fail backends without a graceful stub (or-tools, hol4, acl2, poly/ml) — these crash the build step itself if their upstream is dead, so they're already covered.

Gate semantics

`continue-on-error: true` on the job is preserved. These weekly images are informational, not merge gates — so a stub detection shows as red ❌ inside an amber/yellow job, visible in the Actions UI without blocking. That matches the rest of the `tier3-container` contract.

Companion

Bumps for the stale pins (Poly/ML / OR-Tools / ACL2) shipped in #156. With both this PR and #156 merged, #75's two asks are addressed:

1. ✓ Bump stale pins.
2. ✓ Catch silent stub-degradation in CI before it lingers another month.

Test plan

• Workflow lint / actionlint passes.
• Next weekly Tier-3 cron run shows the new step appearing in each matrix cell.
• Manual probe: if a future pin breaks (or someone simulates it by replacing an upstream URL with a 404 in a fork), the stub-sentinel step fires red.

Refs #75.

🤖 Generated with Claude Code