feat(installer): single-source installer facts (versions, hosts, timeouts, floors) + CI behavior-parity gate (RFC-CLIENT-0003 D3/D4)

[LukasWodka]

Why

The costliest drift class in the 2026-07 installer sweep was facts diverging between the three OS implementations: K3D_VERSION/HELM_VERSION pinned in bash (#382) but not PowerShell (#410) — which then failed a real customer install — and silently bypassed by brew on macOS (#429). The same applies to the external-host list (preflight #416), timeout budgets (#426/#413), and memory floors/recommendations (#417/#428). Copy already solved this with the byte-exact copy catalog; behavior facts need the same treatment. This is decision D3/D4 of RFC-CLIENT-0003.

Scope

• One machine-readable spec under scripts/ (or scripts/spec/): tool versions + checksums, external-host manifest (per-OS), timeout budgets, memory floor/recommendation values.
• Both installers consume it (bash: sourced/generated; PowerShell: generated header or parsed at release-stamp time — pick whichever keeps the R8 single-file bootstrap property).
• Extend drift-checks / gen-manifest --check style CI so a fact changed in one consumer and not the other fails the PR.
• Behavior-parity matrix: a checked-in feature × OS table with explicit waiver entries; CI fails when an implementation gains a behavior without a matrix update (waiver or all-OS).

Acceptance criteria

• Changing a pinned version/host/timeout in one place updates every OS path or fails CI.
• The fix(installer): pin k3d + helm versions in install-k8s.ps1 — drop api.github.com latest lookups #410-class incident (pin present in bash, absent in ps1) is reproducible as a red CI check on a synthetic diff.