fix: enforce bundle step version pins

[marcelsafin]

Description

Enforce bundle-declared version pins for workflow steps before delegating to
workflow step add.

Previously, steps[].version was parsed and documented but ignored by the step
primitive manager. A bundle pinned to one version could therefore install a
different catalog version. This now matches the existing workflow pin behavior
and rejects mismatches before installation starts.

Testing

• Tested locally with uv run specify --help
• Ran existing tests with uv sync && uv run pytest
• Tested with a sample project (if applicable)

Targeted: tests/unit/test_bundler_primitives.py (23 passed).

Full suite: 7,532 passed, 195 skipped. One existing PowerShell-launcher test
was omitted because pwsh is unavailable locally; it fails identically on the
unchanged upstream commit.

AI Disclosure

• I did not use AI assistance for this contribution
• I did use AI assistance (describe below)

GitHub Copilot (GPT-5.6 Sol) autonomously reproduced the bug, wrote the
regression test and implementation, and ran verification under
@marcelsafin's direction and review.

[Copilot]

🟢 Approval recommended

The reviewed changes have appropriate regression coverage and no unresolved issues.

Pull request overview

Enforces bundle-declared version pins when installing workflow steps.

Changes:

• Validates requested step versions against catalog metadata.
• Adds regression coverage ensuring mismatches prevent installation.

File summaries

File	Description
tests/unit/test_bundler_primitives.py	Tests rejection of mismatched step versions.
src/specify_cli/bundler/services/primitives.py	Adds step version-pin validation before installation.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.