feat: automate source plugin pin promotions (#409)

[AntoineToussaint]

Closes#409.

Summary

• Makes the source-checkout launch contract machine-readable, so globally available agent releases can no longer hide a different CLI pin.
• Keeps promotion explicit and reviewable: every owned marker fixture must select the plugin and pass exact-artifact Runtime, Code, Tooling, and source-test qualification before the roster changes.
• Promotes the Go source plugin from 0.0.33 to qualified 0.0.37 as the end-to-end release-candidate proof.

Test plan

• GOWORK=off go test ./... -count=1
• GOWORK=off go vet ./...
• GOWORK=off golangci-lint run --new-from-rev=HEAD ./...
• Built the CLI and observed codefly agent versions report Go 0.0.37 as a promotion candidate over source pin 0.0.33.
• Ran codefly agent promote-source for codefly.dev/go:0.0.37 against the service-go go.mod fixture: the exact public artifact passed Runtime/Code/Tooling and 59 source tests (3 skipped).
• Rebuilt from the generated roster and ran codefly test source without an agent override; it launched codefly.dev/go:0.0.37 and passed TestSettingsYAMLInline.