feat(spec): mandate local/CI toolchain parity in §10.5

[niclaslindstedt]

Summary

• Promotes the existing "Local/CI parity" recommendation in §10.3 to a full mandate in a new §10.5 — Local/CI environment parity. Every language CI pins must have a matching root-level toolchain-pin file so the same Rust / Python / Node / Go version auto-activates locally and prevents "clippy passes locally, fails on CI" round-trips.
• Adds a per-language table in the spec with example bodies (rust-toolchain.toml, .python-version, .nvmrc / .node-version, .go-version) and the tools that auto-activate each one (rustup, pyenv/uv/asdf, nvm/fnm/volta, goenv).
• Ships the five pin files as bootstrap templates under templates/{rust,python,node,go}/ so every generated repo is born compliant. Adds rust-toolchain.toml to this repo to stay self-conformant.
• Wires check_local_ci_parity into oss-spec validate (src/validate.rs). It reads CI workflows, detects language pins, and compares each against the matching root pin file. The comparator tolerates harmless shapes (1.22 ≡ 1.22.0, local 3.12.4 matches CI 3.12) and requires byte-for-byte equality on non-numeric channels (nightly, lts/iron). Pure-docs / Generic repos with no CI toolchain are a no-op.
• Bumps OSS_SPEC.md → v2.1.0 (new mandate = minor) and the README badge to match. Updates §22 bootstrap checklist, the AGENTS.md / template sync-points tables, and the verify-conformance AI prompt so findings aren't duplicated.

Test plan

• cargo test — 64 validate tests, self-conformance, bootstrap smoke all green
• 14 new per-language parity tests cover: matching / missing / mismatched / bare rust-toolchain / nightly / local-more-specific Python / .nvmrc vs .node-version disagreement / lts alias / go.mod directive / 1.22.0 ≡ 1.22
• make lint (clippy -D warnings) — passes
• make fmt-check — passes
• Manual dogfood: oss-spec validate --no-ai on this repo reports clean; tampering rust-toolchain.toml to 1.87.0 surfaces the expected §10.5 violation
• bootstrap_smoke_test still passes — generated Rust project ships the new pin file and is §10.5-conformant out of the box

https://claude.ai/code/session_01GiFmkySZGNYGTDWXnsb7w5