[RefImpl] Check every implementation's AGT pin against agt.lock, and record the OPA version there #314

Refs #74. Raised in the PR #256 review.

reference-implementations/README.md (PR #256) says every maintained Guardian evaluates policy with AGT's runtime at the commit in agt/agt.lock. Only the TypeScript tree checks that, and only partly (test/pin.test.ts compares sdk_version with package.json).

• agt.lock records agt_ref, sdk_package (agent-control-specification, the npm name) and sdk_version. It records no OPA version, though OPA does the evaluation and its version can change results. PR Add a Go Guardian reference implementation #169's own lock pins opa_version 0.70.0, and PR refimpl: add first-stage Rust AGT Guardian #187 hard-requires it.
• PR Add a Go Guardian reference implementation #169 (Go) and PR refimpl: add first-stage Rust AGT Guardian #187 (Rust) copy agt_ref and the version by hand into their own lock files. Nothing compares them with agt/agt.lock, so a bump to it leaves the ports on the old runtime with every CI green.

Proposed:

1. Add opa_version to agt/agt.lock.
2. Each maintained implementation's CI fails when the AGT commit or OPA version it builds against differs from agt/agt.lock.
3. A change to agt/agt.lock updates every maintained implementation in the same PR.