fix(governance): pin tool: just@1.51.0 in mvp-smoke — clear R1 on main (#167)

## Summary

- Governance / Security policy checks fails on every push to main with
`❌ [R1] unversioned family-tool install:
.github/workflows/mvp-smoke.yml:43: tool: just` because PR #130 added a
bare `tool: just` line.
- R1 regex
`^[[:space:]]*tool:[[:space:]]*(just|must|trust|adjust|bust|dust|intend)[[:space:]]*$`
requires versioned pins — any bare family-tool install is treated as
supply-chain risk.
- Pin to `just@1.51.0` (current upstream stable per `gh api
repos/casey/just/releases/latest`). The `taiki-e/install-action` accepts
the `<name>@<ver>` form natively. Inline comment notes the rule so the
next contributor won't strip the pin when bumping the action SHA.

## Why this matters now

Governance is a required status check on the merge ruleset. Until R1 is
clean on main, every new PR (including the in-flight #165 and #166) sits
at `BLOCKED` and needs `--admin` to land. This is the upstream-first
foundational fix: clear the baseline red so the rest of the queue can
auto-merge as designed.

## Test plan

- [x] `grep -rnE
'^[[:space:]]*tool:[[:space:]]*(just|must|trust|adjust|bust|dust|intend)[[:space:]]*$'
.github/workflows/` → no matches
- [x] `python3 -c "import yaml; yaml.safe_load(...)"` parses OK
- [ ] `governance / Security policy checks` job → success on this PR

Author: hyperpolymath

.github/workflows/mvp-smoke.yml

@@ -40,7 +40,11 @@ jobs:
       - name: Install just
         uses: taiki-e/install-action@184183c2401be73c3bf42c2e61268aa5855379c1 # v2.78.1
         with:
-          tool: just
+          # Governance R1 requires versioned family-tool pins
+          # (just|must|trust|adjust|bust|dust|intend); bare `tool: just`
+          # tripped the Security policy check on every push to main since
+          # #130 landed (2026-05-30). 1.51.0 is the current upstream stable.
+          tool: just@1.51.0
 
       - name: Build release
         run: cargo build --release