Tie harness version and workflow to one release

[danielholanda]

Make the pinned ref the harness version

The problem

The README says to pin reusable.yml@v0.1.0, but that doesn't get you harness
v0.1.0. At that tag, every job says uses: amd/skillscope@main, and the action's
fallback is its own ref — so you got v0.1.0's workflow running whatever main
looked like that morning. Nothing about the run looked wrong.

Four things could decide the version: the version input, $SKILLSCOPE_VERSION,
skillscope_version in each skill's evals.json, and the launcher's ref. None of
them was the ref you actually pinned. That ladder existed for a "pin @bootstrap
forever, bump the version as data" story that overlaps with pinning a release tag,
and beat it.

The fix

uses: amd/skillscope@v0.1.1 already downloads this whole repo at that tag into
$GITHUB_ACTION_PATH. That checkout is the harness, so the launcher just
installs from there — uvx --from $GITHUB_ACTION_PATH skillscope <command>. The
pin is right by construction, and the default path never touches the network.
version stays as the one override, for trying a build before pinning it.

Gone with the ladder: bootstrap/resolve_version.py, skillscope_version and
everything reading it (pinned_version, config.version, select --version, the
plan's version fields), and the skill: / source: action inputs.
bootstrap/launch.py moves to action/launch.py at half the size.

Two things stop the literal ref drifting again, since uses: can't be an
expression: a test that fails unless pyproject.toml, __version__, and all 19
uses: amd/skillscope@… references agree, and a selftest that asserts the version
the action reports is the one in the checkout.

Heads up

Delete skillscope_version from your evals.json if you have it. The parser
rejects unknown top-level keys, so leaving it fails the structural check. Nothing
replaces it — the version is the ref you pinned.

v0.1.1 has to be tagged with this merge. Everything points at it, so
reusable.yml@main can't resolve the action until that tag exists. v0.1.0 stays
broken; v0.1.1 is the first tag where pinning does what the README says.

208 tests pass. Net 225 insertions, 719 deletions.

[danielholanda]

PR #10 is more elegant