dev: single-source the Compact toolchain version

Problem

The Compact compiler version is pinned in three places that can drift apart, and nothing detects it:

So CI and local developers compile with different compilers, silently.

Why it matters

Compatibility pins (golden digests, ledger layout, circuit surface) are computed from whatever the local toolchain produced. If a patch bump ever changes codegen, a locally green suite can be red in CI, or worse the reverse.

Verified benign today: rebuilding MockConfidentialNoteFungibleToken under 0.31.0 and 0.31.1 gives byte-identical digests, ledger layout, and circuit surface. This is a latent trap, not a live break.

Proposal

Single-source the version so CI, release, docs, and local installs cannot disagree:

• One file (e.g. .compact-version) read by the setup action, the release workflow, and a compact update helper script.
• Generate or check the README badge and snippet from it.
• Optionally fail CI when the built artifact's compiler-version differs from the pin.

Acceptance criteria

• Exactly one place declares the compiler version.
• CI, release, and README derive from it.
• A mismatch between the pin and the built artifact's compiler-version is visible rather than silent.
• Documented supported range, or the pin bumped to 0.31.1 so CI and local agree.

Start by tracing the version declarations in .github/actions/setup/action.yml, .github/workflows/release.yml, and the README.md badge and install snippet, then inspect how the current local compact update works. Define the single source and how CI and release consume it, including the artifact compiler-version check. Done means the acceptance criteria hold without version drift.