ci: precheck checker pin and runner before authenticated repair

IR-135: thin and golden workflows silently sent a stale checker into a
private-source clone. An absent token surfaced as auth exit 128 before
coverage, hiding the independent pin/runner disagreement.

Share the 0.4.1 pin and installer. Report the actual version and native
version exit before repair; refuse a missing credential before clone or
build. Keep matching installs tokenless, authenticated source repair, and
native clone failures. Check the repaired version before coverage.

Linux shell regression: 8/8; predecessor stale/no-token case exits 128
where successor names pin/box and missing credential at exit 1. Real
kitsubito installed-binary precheck/install smoke exits 0 without a token.
Workflow YAML parsed; traceable-reqs 0.4.1: 919 complete, 0 findings.
No live PAT provisioning or source build. No Rust/product code changes.

Co-authored by: hertz