fix: pin cascade self-action ref to immutable version tag

[joshua-temple]

Problem

The self-action stablekernel/cascade/.github/actions/setup-cli was referenced at the mutable @latest/@master ref by default. A compromise of this action repo would execute in every consumer's CI without any explicit version pinning.

Fix

• Added DefaultCLIVersion = "v0.1.0" constant in internal/config as the maintained source-of-truth pin (the latest stable tag).
• GetCLIVersion() now returns DefaultCLIVersion when cli_version is unset or explicitly set to "latest". The "beta" value remains as an explicit, opt-in escape hatch that resolves to @master.
• All eight generator getCLIRef() methods updated to be consistent with the new default. Explicit version tags (vX.Y.Z) pass through unchanged.
• Pin is fully overridable via cli_version in the cascade manifest.

Bumping the pin on release

Update DefaultCLIVersion in internal/config/types.go as part of the release process when a new stable tag is created.

Verification

• Unit tests added/updated: TestGetCLIVersion and TestGetCLIRef_DefaultIsPinnedNotMutable
• go build ./... && go test ./... - pass
• cd e2e && go build ./... && go vet ./... - pass
• golangci-lint run ./... - clean