dev: use the pinned Zig toolchain instead of any PATH binary

Problem

Root scripts such as build:core, test, fmt, and run use this pattern:

command -v zig >/dev/null 2>&1 || eval "$(pantry env ...)"

That treats any Zig on PATH as compatible and skips the version pinned in pantry.lock. Zig dev snapshots are not source-compatible: on this checkout, PATH Zig 0.17.0-dev.2163 fails the default build against zig-js with eight std/API-layout errors, while CI uses the pinned Pantry toolchain (0.17.0-dev.1963). The script therefore defeats the reproducibility the lockfile is meant to provide.

This was found during the release-readiness audit following #254, #242, and #220. It is outside those issue lanes.

Suggested acceptance criteria

• Route repository build/test/run/format scripts through the toolchain resolved from pantry.lock, or validate the PATH Zig against the pinned compatible version before using it.
• Print the selected Zig path/version before compilation.
• Fail early with a concise remediation message when the pinned toolchain cannot be resolved.
• Add a deterministic script test where an incompatible zig exists earlier on PATH.
• Keep an explicit opt-in available for maintainers intentionally testing a different Zig snapshot.