fix: reject a system toolchain older than the revision's pin

[ralyodio]

Running the published launcher with an older Bun fails with a message about the repository rather than about the caller:

$ curl -fsSL https://hqtui.com/demo.sh | sh -s -- --system typescript
bun install v1.3.14
error: Unknown lockfile version   at bun.lock:2:22
warn: Ignoring lockfile
error: lockfile had changes, but lockfile is frozen

Bun 1.3 cannot parse our lockfileVersion: 2 bun.lock, drops it, and then fails the frozen install. Nothing was wrong with the repository; the caller had Bun 1.3.14 on PATH while this revision pins 1.4.0.

Fix

demo.sh already reads each revision's pinned version from mise.toml for --mise. In --system mode it now also probes the resolved driver and compares the two, failing before any install or build:

hqtui-demo: This revision pins bun 1.4.0, but /…/installs/bun/1.3.14/bin/bun is 1.3.14.
Install bun 1.4.0 or newer, or rerun with --mise to build against the pinned toolchain.

A newer toolchain still passes, and --mise is unaffected. The gate covers every language: bun/cargo/cmake/ruby --version, go/zig version, php -r 'echo PHP_VERSION;' and Perl's $^V. Comparison is field-wise numeric, so 3.14 beats 3.12 and Perl's three-field 5.44.0 satisfies the four-field pin 5.44.0.0.

Tests

apps/demo/scripts/test-updater.py gains:

• test_typescript_installs_and_builds_once_per_revision — the TypeScript path had no coverage in this harness at all, under either manager.
• test_system_tool_older_than_the_pin_fails_before_any_build — all three probe shapes, asserting nothing was installed or built, that a newer tool passes, and that --mise still works with an old tool on PATH.

Both fail against the unfixed demo.sh. The Python fixture now pins the caller's own python3 so the update/caching tests do not depend on how new the host interpreter is, and the build counters match build invocations rather than tool names so version probes do not inflate them.

Verified locally: 13/13 updater tests, 167 bun tests, bun run typecheck, next build, shellcheck -s sh (only the pre-existing SC2016 at line 252), and a real end-to-end run of the launcher against both Bun 1.3.14 (now a clear failure) and Bun 1.4.0 (installs, builds, renders).

🤖 Generated with Claude Code

https://claude.ai/code/session_01TbGYCRHZsZUsQwRCLafhMF