build system: integrate versioning machinery into CI + engine blake3/transient reconcile

Integration (answers 'does it run automatically'):
 - redbear-ci.yml now runs test-versioning-machinery.sh (33 cases) and
   verify-external-source-versions.sh on every push/PR; trigger widened to
   0.3.* so a release-branch increment keeps CI (and these checks) firing.
 - The validator already runs in build-preflight.sh Phase 1.0C (every build),
   and bump-graphics-recipes.sh (invoked by bump-release.sh --with-external)
   now calls the sync engine — so an external bump propagates + is validated.

Engine hardening (both regression-tested):
 - reconcile_blake3: a vendored bump often left recipe blake3 stale (URL bumped,
   hash not); the engine now sets recipe blake3 to the authoritative source.tar
   hash (only when source.tar version matches the URL version; no-op under --check).
 - transient recipes (no vendored source/) now get their stale cached source.tar
   bumped to the declared version too, instead of being skipped.

.github/workflows/redbear-ci.yml

@@ -2,7 +2,10 @@ name: redbear-ci
 
 on:
   push:
-    branches: [0.3.1, master]
+    # Glob so a release-branch increment (0.3.1 -> 0.3.2 -> ...) keeps triggering
+    # CI — including the versioning-machinery checks below — without editing this
+    # file on every bump.
+    branches: ["0.3.*", master]
   pull_request:
 
 jobs:
@@ -25,6 +28,19 @@ jobs:
       - name: Check sync-versions compliance
         run: ./local/scripts/sync-versions.sh --check
 
+      - name: Install b3sum (versioning machinery + validator)
+        run: sudo apt-get update && sudo apt-get install -y b3sum
+
+      - name: Versioning machinery unit tests
+        run: ./local/scripts/test-versioning-machinery.sh
+
+      - name: External recipe source-version consistency
+        # Fails if any tar recipe's vendored source/ (or tracked source.tar)
+        # diverges from its declared version — the Qt/KDE class of bug. Mirrors
+        # build-preflight.sh Phase 1.0C so divergence is caught on every push/PR,
+        # not only at build time.
+        run: ./local/scripts/verify-external-source-versions.sh
+
       - name: cargo fmt check (redbear-* crates)
         run: |
           set -e