IR-135: thin and golden CI report the shared checker pin and the runner binary's actual version before any repair. A matching binary needs no credential; a missing, failing or mismatched binary without `TRACEABLE_REQS_TOKEN` refuses before clone or build, naming both the version disagreement and the missing credential instead of letting a token-less clone surface as an authentication failure. Authenticated repair keeps native failures.

Gate (doyle, isolated worktree at 52d56248): `.github/ci/traceable-reqs-selftest.sh` 8/8 on Windows git-bash; predecessor red reproduced (stale-no-token exit=128); `traceable-reqs check` 0.4.1 exit 0; kitsubito installed-binary smoke matches pin. Proof: `.spt/preserved/hertz-ir135-checker/`.

New REQ: `REQ-CI-CHECKER-PIN-PRECHECK` (doc/impl/unit). CI-only lane, no product change.

Co-authored by: hertz

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01SgutL1VJbbSwoa7NSsKuHp