CI: pin the validated Zig dev.1818 toolchain across required checks

Parents: #494, #500

Problem

The required workflow asks Pantry for the moving alias zig@0.17.0-dev at six independent setup points. After resolving dev.1818 successfully earlier in the same day, Pantry registry resolution stopped mapping that alias and every code job in runs 32361909093 and 32364117973 failed before compilation. The docs-only job passed.

The tree, dependency pins, and current local/Linux evidence already target Zig 0.17.0-dev.1818+7051f8e73; following an unversioned development head also lets compiler behavior drift between otherwise identical pushes.

Required implementation

• Declare the exact validated dev.1818 toolchain once for the CI workflow.
• Make every Pantry setup consume that one pin, including unit/corpus, TSan, ReleaseSafe, nightly, and Test262 jobs.
• Update workflow documentation so it no longer claims the compiler intentionally floats.
• Preserve every command, matrix leg, sanitizer, corpus, and semantic gate unchanged.

No-workaround rules

• Do not bypass Pantry, vendor a compiler, weaken a gate, retry until a moving alias happens to resolve, or silently use a different compiler per job.

Acceptance

• Workflow syntax and dependency audit pass.
• A fresh push shows every Pantry setup requesting the same exact compiler.
• Required code jobs reach compilation under that pin; any later code failure remains visible as its own result.

Related: #626

Implemented by adcf6926. One workflow-level ZIG_VERSION now pins 0.17.0-dev.1818+7051f8e73, and all six Pantry setup sites consume it without changing any matrix command or semantic gate. The generated platform evidence now reproduces the current 39-entry Linux matrix and updated workflow digest; YAML parsing and generator write/check pass. Keeping this open until the fresh run proves Pantry resolves the exact pin and code jobs reach compilation.

Implemented in adcf6926, with the regenerated platform manifest landed in 248ed3b1. The first exact-pin run successfully installed Zig 0.17.0-dev.1818 and compiled/ran native jobs; its docs failure was the expected stale rendered manifest, now refreshed. Fresh validation: CI run 32369900898. Keeping this open until that run confirms the pin and docs gate together.

The remaining classified dependency record is aligned by db5d0e5a: it now names the same exact 0.17.0-dev.1818+7051f8e compiler as the workflow instead of describing a floating dev channel. Local dependency audit, platform-matrix check, docs link check, and checked docs build all pass (0 test262 flips).

Fresh Linux run 32385115603 shows the exact pin resolving and code reaching its real gates: unit shard 0, TSan unit shard 0, dependency audit, and docs all passed. Other later code failures remain independently visible rather than being masked by toolchain setup. Closing #646 as completed.