CI: bootstrap pinned ripgrep without mutable registry lookup

Parents: #494, #646

Problem

Fresh CI run 32369900898 proves the exact Zig dev.1818 pin resolves and native jobs reach execution, but every home_tool matrix leg then spends roughly 20 minutes in pantry install crates.io/ripgrep@15.1.0 --no-save before failing package ... not found in registry. This independently fails focused-engine, ABI, benchmark, thread-inventory/reference, and most Wasm jobs before their real gates run.

The Home repository tools require rg; the moving Pantry recipe registry is not a durable representation of that pinned tool dependency.

Required implementation

• Bootstrap the exact upstream ripgrep 15.1.0 Linux x86-64 artifact used by these Ubuntu jobs from a revisioned release URL.
• Verify a checked-in SHA-256 before extraction and add only the extracted tool directory to PATH.
• Keep the dependency version and digest declared once for every home_tool matrix leg.
• Preserve the exact Zig Pantry setup and every downstream matrix command/gate.
• Update generated workflow evidence if the workflow digest changes.

No-workaround rules

• No ambient runner rg, unverified download, floating latest URL, mutable package alias, retry loop, skipped Home tool, or reduced matrix.
• Do not bypass Pantry for Zig; this issue owns only ripgrep bootstrap durability.

Acceptance

• Workflow/YAML and generated-platform checks pass with the new digest.
• A local checksum check proves the declared digest matches the exact upstream archive.
• A fresh Linux push installs ripgrep once per relevant job and rg --version reports 15.1.0.
• Focused-engine, ABI, benchmark, thread, and Wasm Home-tool-backed jobs reach their real commands instead of failing setup.

Implemented and pushed in 9b359d8f. All 11 Home-tool matrix entries now use the upstream ripgrep 15.1.0 static Linux archive, verify 1c9297be4a084eea7ecaedf93eb03d058d6faae29bbc57ecdaf5063921491599, and publish only that extracted directory to later steps.

Local evidence: the upstream .sha256 matches; the archive verifies and extracts to a static x86-64 ELF; CI YAML parses; the generated platform manifest is current; dependency audit passes with 16 classified edges and 60 repository tools. Fresh Linux execution remains the closure gate.

Fresh Linux run 32385115603 confirms the pinned bootstrap end to end. The benchmark harness log verifies the declared archive digest (OK) and reports ripgrep 15.1.0 (rev af60c2de9d) before the Home tool runs. Home-backed gates then reached their real commands: benchmark, thread inventory, thread reference audit, and multiple Wasm profiles passed; focused-engine and private-ABI also got past installation and exposed separate later gate results. The mutable Pantry ripgrep lookup no longer masks any matrix command. Closing #652 as completed.