chore(wave3): bump Poly/ML 5.9.1→5.9.2, OR-Tools 9.12→9.15, ACL2 8.6→8.7 (#156)

## Summary

Verification pass on the Wave-3 brittle upstream pins tracked in #75.
Five upstreams checked against latest GitHub releases (or git tags for
ACL2, which doesn't ship GitHub Releases):

| Backend | Was | Latest | Action | Risk |
|---|---|---|---|---|
| Poly/ML | 5.9.1 | 5.9.2 (2025-08-11) | bumped | patch — low |
| OR-Tools | 9.12.4544 | 9.15.6755 (2026-01-12) | bumped (+BUILD) |
minor×3 — moderate |
| SCIP | 10.0.2 | 10.0.2 (2026-04-02) | current ✓ | — |
| ACL2 | 8.6 | 8.7 (git tag) | bumped | minor — low |
| Tamarin | 1.12.0 | 1.12.0 (2026-03-07) | current ✓ | — |

Also checked: HOL4 `trindemossen-2` (latest as of 2025-08-12, current
✓).

## URL hygiene

All five existing-pin asset URLs HEAD-resolved before the bump, so no
dead-URL stub-degradation (the original #75 concern about graceful
fallbacks hiding drift) was masking a download failure at this
snapshot. After this PR lands, the same set of URLs has been
HEAD-checked for the new tags. The smoke that #75 also asks for
(weekly assertion that `--version` returns the real prover, not the
stub sentinel) is a separate piece of work — not in this PR.

## OR-Tools BUILD coupling

The OR-Tools archive name embeds both VERSION and BUILD:
`or-tools_amd64_debian-12_cpp_v9.15.6755.tar.gz`. Both ARGs must move
together on any version bump. The inline comment has been updated to
reflect the new example so the next reader has the current reference
point.

## Test plan

- [ ] Wave-3 container builds successfully on CI
(`.github/workflows/cargo-audit.yml` / any Wave-3 smoke that exercises
Containerfile.wave3).
- [ ] OR-Tools v9.15 C++ FFI surface still matches downstream Rust
callers (the 3-minor-version jump is the highest-ABI-risk change here).
- [ ] ACL2 8.7 `saved_acl2.core` builds with the SBCL recipe in the next
stage.
- [ ] Poly/ML 5.9.2 is a patch bump from 5.9.1 — `configure && make &&
make install` recipe unchanged.

Refs #75.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.containerization/Containerfile.wave3

@@ -399,11 +399,11 @@ WORKDIR /opt/or-tools
 # The tarball ships include headers, shared libraries, and CMake config files.
 # Check https://github.com/google/or-tools/releases for the latest version.
 # NOTE: upstream release assets ALWAYS carry the build number, e.g.
-#   or-tools_amd64_debian-12_cpp_v9.12.4544.tar.gz   (NOT ..._v9.12.tar.gz)
+#   or-tools_amd64_debian-12_cpp_v9.15.6755.tar.gz   (NOT ..._v9.15.tar.gz)
 # so ORTOOLS_BUILD must track the exact build for the tag (verified via the
-# GitHub releases API for tag v9.12). Bump both together on any version change.
-ARG ORTOOLS_VERSION="9.12"
-ARG ORTOOLS_BUILD="4544"
+# GitHub releases API for tag v9.15). Bump both together on any version change.
+ARG ORTOOLS_VERSION="9.15"
+ARG ORTOOLS_BUILD="6755"
 ARG ORTOOLS_ARCHIVE="or-tools_amd64_debian-12_cpp_v${ORTOOLS_VERSION}.${ORTOOLS_BUILD}.tar.gz"
 ARG ORTOOLS_URL="https://github.com/google/or-tools/releases/download/v${ORTOOLS_VERSION}/${ORTOOLS_ARCHIVE}"
 
@@ -501,7 +501,7 @@ WORKDIR /build/polyml
 # auto-generated source tarball for the tag (always present), with the
 # releases/download form as a fallback for any version that does ship one.
 # The archive tarball extracts to polyml-<version>/ → --strip-components=1.
-ARG POLYML_VERSION="5.9.1"
+ARG POLYML_VERSION="5.9.2"
 RUN set -eux; \
     curl -fsSL --retry 3 \
       "https://github.com/polyml/polyml/archive/refs/tags/v${POLYML_VERSION}.tar.gz" \
@@ -621,7 +621,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # such file or directory" at runtime. Build in-place at /opt/acl2 so the
 # baked paths are correct in the runtime image (ACL2_SYSTEM_BOOKS=/opt/acl2/books).
 # Check https://github.com/acl2/acl2/releases for the latest version.
-ARG ACL2_VERSION="8.6"
+ARG ACL2_VERSION="8.7"
 RUN git clone --depth 1 --branch "v${ACL2_VERSION}" \
       https://github.com/acl2/acl2.git /opt/acl2 \
     || git clone --depth 1 \