Compare versions when bootstrap installs a pinned tool (closes #28)

The canonical `if missing <tool>; then install; fi` guard tests PATH
presence and never version, so on any already-provisioned machine a pin
is inert and a version bump is a no-op, while the Dockerfile installs the
pinned version into a clean image and CI then disagrees with local about
what the tool is. Comparing versions alone is not enough either: an
installer writes to its own directory while callers resolve through PATH,
so a shadowing binary lets the install succeed and change nothing anyone
sees. REPO_POLICIES.md now states the whole form — exact whole-token
comparison, mis-parse falling through to a reinstall, re-resolution
through PATH after installing, and a call site that prints the version.

Model: opus-5

TODO.md

@@ -21,6 +21,11 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-09-08: Made a pinned tool in `script/bootstrap` actually reach the host.
+  `REPO_POLICIES.md` now requires comparing the installed version against the
+  pin rather than testing `PATH` presence, and re-resolving the binary through
+  `PATH` after installing, so a version bump cannot be a silent no-op and a
+  shadowed install cannot report success.
 - 2026-09-08: Closed the false green in the canonical CI gate: `script/cibuild`
   and `script/docker` now build with `--no-cache`, so the Dockerfile's check
   layers cannot be served from cache on an unchanged tree, and the text claiming