Pin keep repo commit SHA in a single source of truth

[kwsantiago]

Problem

CI pins keep to a specific SHA (currently 81a820f6... duplicated in both ci.yml and release.yml). Local developers clone keep at main, so their build may use a different version than CI. This produces drift and blocks reproducibility.

Proposal

Introduce a single keep.version file at repo root containing the pinned SHA.

1. ci.yml and release.yml: replace hardcoded SHAs with $(cat keep.version) in the actions/checkout steps.
2. Gradle verifyKeepVersion task wired into :app:preBuild alongside buildRust. It reads keep.version, runs git -C $KEEP_REPO rev-parse HEAD (following symlinks, so sibling-repo layouts work), and compares.
3. On missing keep/ the task errors with the exact clone + checkout command. No auto-clone.
4. On SHA mismatch the build fails with an actionable error suggesting git -C keep checkout <pinned-sha>.
5. Bumping the pin is a manual edit to keep.version; no Gradle helper task in this issue.

Acceptance

• CI and local builds use the same keep commit
• Bumping is a single-file change
• Mismatch produces an actionable error, not a mysterious binding failure
• Works with symlinked keep/ layouts (checks resolved target's HEAD, not path)

Follow-up from #221.