ci: align base-bash-libs workflow pins with GA (#1992)

[codeforester]

Summary

• Align the macOS, integration, and Ubuntu source-checkout jobs in
  .github/workflows/tests.yml with the published base-bash-libs v2.0.0 GA
  commit b4243765726c133499feeabdc50154f99c0fec12.
• Add a workflow-contract test that requires every base-bash-libs checkout in
  the Tests workflow to use the same immutable GA revision.
• Record the invariant in .ai-context/WORKFLOWS.md.

Issue

Fixes #1992.

Validation

• Focused workflow and CI supply-chain tests: 52 passed.
• Full local gate: 999 Python tests passed and 891 BATS tests passed.
• git diff --check passed.
• Static audit confirms all four base-bash-libs checkouts in tests.yml use
  the GA commit and the RC commit is absent.

Demo Impact

None. This changes only CI dependency pins and their regression coverage.