fix(ci): bootstrap pin 指向了索引里已经没有的版本

aarch64 fresh-install job 在 clone 出 mcpp 源码后直接死在:

    [error] xlings: version '2026.8.4.1' not found for 'mcpp'
    [error]   available: 2026.8.5.1

`.xlings.json` 的 bootstrap pin 停在 2026.8.4.1,而 **xim-pkgindex 只保留一个
mcpp 版本**。2026.8.5.1 一发布,2026.8.4.1 就不再可安装 —— 于是「从已发布的
mcpp 自举」这条路当场断掉。

pin 挪到 2026.8.5.1(= 当前最新已发布版本)。

顺带把这条不变式写进 check_version_pins.sh:此前那段注释只讲了**上界**
(「绝不能跑在被构建版本前面」,那是它自己踩过的坑),没讲**下界**。两边合起来
才是完整规则:**发布 N 之后,发布收尾的那个 commit 把 pin 设成 N** —— 不能超前
(check (c) 机器校验),也不能落后超过一个版本(校验不了,它需要索引,所以只会以
上面那条错误现身;注释里写清楚了下次去哪儿看)。

Author: speak-agent

.github/tools/check_version_pins.sh

@@ -140,6 +140,19 @@ fi
 #     what an earlier revision of this script got wrong: it sent CI to install a
 #     version that did not exist yet, and every job died with
 #     `package 'mcpp@<unreleased>' not found`.
+#
+#     But it may lag by exactly ONE release, no more. xim-pkgindex carries a
+#     SINGLE mcpp version — the newest — so the moment a release lands, every
+#     older pin names something that is no longer installable:
+#
+#         [error] xlings: version '2026.8.4.1' not found for 'mcpp'
+#         [error]   available: 2026.8.5.1
+#
+#     which is how the aarch64 fresh-install job died after 2026.8.5.1 shipped.
+#     The rule that satisfies both directions: after publishing release N, the
+#     post-release commit sets this pin to N. Never ahead (check (c)), never
+#     more than one behind (not checkable here — it needs the index — so it
+#     surfaces as the error above, and this note is where to look when it does).
 
 # (c) …and the bootstrap pin must never run AHEAD of the version being built.
 #     Four-key numeric sort, so the date scheme orders correctly (a plain

.xlings.json

@@ -1,5 +1,5 @@
 {
   "workspace": {
-    "mcpp": "2026.8.4.1"
+    "mcpp": "2026.8.5.1"
   }
 }