[HIGH-3] OSCAL version drift — POA&M/SAR emit 1.0.6, SSP emits 1.1.2

## Problem

The OSCAL serializers are not version-consistent:
- POA\&M and SAR emitters target **OSCAL 1.0.6**
- SSP emitter targets **OSCAL 1.1.2**

eMASS and other downstream consumers reject mixed-version packages. An SSP, SAR, and POA\&M generated in the same SPIN Agent session will fail package validation at submission time.

## Evidence / Location

- POA\&M serializer: OSCAL version declared as `1.0.6`
- SAR serializer: OSCAL version declared as `1.0.6`
- SSP serializer: OSCAL version declared as `1.1.2`

## Fix

1. Establish a single `OscalVersion` constant (recommend `1.1.2` as the current stable release) shared across all serializers.
2. Update POA\&M and SAR serializers to emit `1.1.2`.
3. Add a serializer integration test that asserts all three artifact types declare the same OSCAL version in a single generation run.

## Source Reviewers

Vision — HIGH

---
> ⚠️ **Caveat:** All findings are static read-reviews; build/tests were not run. Reproduce before treating fix as confirmed.
> 📋 **Note:** War Machine's ATO/RMF findings are still pending and will be folded in as a second batch.

Locate the POA&M, SAR, and SSP serializers and inspect where each OSCAL version is declared. Trace their shared generation path, then add the requested integration test and verify that all three artifact types emit the same version in one generation run.

Written by the indexing model from the issue text.