fix: enforce bundle step version pins

[marcelsafin]

Description

Enforce bundle-declared version pins for workflow steps before delegating to
workflow step add.

Previously, steps[].version was parsed and documented but ignored by the step
primitive manager. A bundle pinned to one version could therefore install a
different catalog version. This now matches the existing workflow pin behavior
and rejects mismatches before installation starts.

Testing

• Tested locally with uv run specify --help
• Ran existing tests with uv sync && uv run pytest
• Tested with a sample project (if applicable)

Targeted: tests/unit/test_bundler_primitives.py (23 passed).

Full suite: 7,532 passed, 195 skipped. One existing PowerShell-launcher test
was omitted because pwsh is unavailable locally; it fails identically on the
unchanged upstream commit.

AI Disclosure

• I did not use AI assistance for this contribution
• I did use AI assistance (describe below)

GitHub Copilot (GPT-5.6 Sol) autonomously reproduced the bug, wrote the
regression test and implementation, and ran verification under
@marcelsafin's direction and review.

[Copilot]

🟢 Approval recommended

The reviewed changes have appropriate regression coverage and no unresolved issues.

Pull request overview

Enforces bundle-declared version pins when installing workflow steps.

Changes:

• Validates requested step versions against catalog metadata.
• Adds regression coverage ensuring mismatches prevent installation.

File summaries

File	Description
tests/unit/test_bundler_primitives.py	Tests rejection of mismatched step versions.
src/specify_cli/bundler/services/primitives.py	Adds step version-pin validation before installation.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mnriem]

This is excellent work — you've filed a focused, well-tested set of bundle-integrity fixes (#4466–#4470: component scoping, duplicate rejection, step-version mismatch, record-save rollback, and version-pin enforcement), all green with regression coverage and clear disclosure. Genuinely high-value stuff.

One process note: that's 5 open PRs, past the 3-open-PR guidance in CONTRIBUTING, and since they're all the same theme touching the bundler, they'd be much faster to review as a single consolidated PR (or a smaller stack) rather than five separate ones. Could you group the related ones? I want to land these — consolidating just helps them move quicker. Marking this one author-awaiting on that.

[Copilot]

🟢 Approval recommended

The focused implementation correctly mirrors existing workflow validation and includes adequate regression coverage.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced