refactor(generate): promote the shared pin-reconcile core

[joshua-temple]

Problem

The action-pin drift scanner lived only inside a test file, and there was no way to read the incoming ref from a changed workflow line, load an action-pin table from an arbitrary disk path, overlay those pins onto a config for a pinned-binary regenerate, or fold multiple observed refs into a single adopted value. These are the shared primitives a pin-reconciliation engine needs.

Fix

Adds the load-bearing, source-agnostic reconcile core (no CLI wiring yet):

• Promotes the drift scanner into production internal/generate/pin_scan.go (PinMismatch, ScanUsesForPinDrift, LoadEmbeddedPinManifest) and rewires the existing consistency/anchor tests to the exported names, behavior-preserving.
• Adds ParseUsesLine to parse a single uses: line into its action and verbatim ref.
• Adds internal/generate/pin_load.go: LoadActionPinTable (disk pin loader) and ApplyDiskPinOverrides (overlay disk pins onto cfg.ActionPins, with an explicit user pin still winning), so a version-pinned binary regenerates against the repo's current pins across every sub-generator.
• Adds internal/pinreconcile/consensus.go (consensusRef, refuse-on-ambiguity) and internal/pinreconcile/reconcile.go (PlanAdoptions, verbatim governed-pin adoption that never touches ungoverned actions).

Verification

• go build ./..., go test ./... (2383 passed), golangci-lint run ./... all clean.
• Each primitive lands with focused unit tests. These are pure library primitives with no production callers yet; the e2e adoption scenario ships with the command that wires them.
• Independent review passed.

Part of #440.