fix(dev): validate the pinned Zig toolchain before builds

Summary

• Validate the PATH Zig or explicit CRAFT_ZIG against the exact root system dependency in pantry.lock, including the snapshot commit hash.
• Fail before compilation with an actionable error; print the selected compiler path/version and retain CRAFT_ALLOW_UNPINNED_ZIG=1 for intentional compatibility tests.
• Route root build, test, run, format and Zig commands through the wrapper without silently invoking Pantry's dependency-rewriting environment setup.
• Document the supported local workflow and run deterministic shadowed-PATH regressions in CI.

Closes #275.

Validation

• Before: bun run zig version silently selected PATH 0.17.0-dev.2163+89ff10d56 despite the locked 0.17.0-dev.1963+e00c6c439.
• After: the same command fails early with both versions and remediation instructions.
• Four fixture tests pass, covering PATH shadowing, explicit pinned selection, deliberate unpinned opt-in, malformed/missing toolchains, argument/working-directory/version forwarding and compiler exit status.
• Root typecheck, focused Pickier, and pinned Zig format checks pass.