Have a "pinned" install mode where Hermit and the manifest repos are pinned at specific versions?

- The Hermit env would need the version of itself pinned in its bootstrapping script.
- The source versions would need to be pinned in `bin/hermit.hcl` - this is already possible.
- Sources would need to become version aware. eg. the git source would need perhaps a query parameter to specify the ref to clone, such as `https://github.com/squareup/hermit-packages.git?ref=xyz`

Start by reading the bootstrapping script and `bin/hermit.hcl`, then trace how the git source is resolved and cloned. Define the pinned Hermit version, manifest repository versions, and source refs as the completion criteria; no tests are named in the issue, so identify the relevant install or source-resolution tests before changing behavior.

Written by the indexing model from the issue text.