fix(governance): pin tool: just@1.51.0 in mvp-smoke — clear R1 on main

Governance / Security policy checks fails on every push to main with:

    ❌ [R1] unversioned family-tool install: .github/workflows/mvp-smoke.yml:43:          tool: just
    ❌ [R1] 1 unversioned family-tool install(s) — pin tool: <name>@<ver>

Source: R1 in the governance workflow greps for
`^[[:space:]]*tool:[[:space:]]*(just|must|trust|adjust|bust|dust|intend)[[:space:]]*$`
across `.github/workflows/**`. PR #130 (2026-05-30) added the bare
`tool: just` line to mvp-smoke.yml when it fixed `just: command not
found`. The governance rule treats any bare family-tool install as
supply-chain risk because each invocation would silently pull whatever
version `taiki-e/install-action` resolves at that moment.

Fix: change `tool: just` → `tool: just@1.51.0` (current upstream stable
per `gh api repos/casey/just/releases/latest`). The action accepts the
`<name>@<ver>` form natively; the regex no longer matches; downstream
PRs stop being held up by a baseline-red required check.

Adds an inline comment so the next contributor doesn't strip the pin
when bumping the action SHA.

Verification:

    grep -rnE '^[[:space:]]*tool:[[:space:]]*(just|must|trust|adjust|bust|dust|intend)[[:space:]]*$' .github/workflows/
    # (no matches)

YAML safe_load passes; the rest of the file is untouched.

Author: hyperpolymath

.github/workflows/mvp-smoke.yml

@@ -40,7 +40,11 @@ jobs:
       - name: Install just
         uses: taiki-e/install-action@184183c2401be73c3bf42c2e61268aa5855379c1 # v2.78.1
         with:
-          tool: just
+          # Governance R1 requires versioned family-tool pins
+          # (just|must|trust|adjust|bust|dust|intend); bare `tool: just`
+          # tripped the Security policy check on every push to main since
+          # #130 landed (2026-05-30). 1.51.0 is the current upstream stable.
+          tool: just@1.51.0
 
       - name: Build release
         run: cargo build --release