Enforce merged EIP reference-spec pins as a release gate

## Problem

`spec.py` `REFERENCE_SPEC_VERSION` is being adopted downstream (devnet spec sheets, automated debugging tooling) as the source of truth for the *as-implemented* EIP version. Two things make it untrustworthy today:
- It drifts silently. The value is set by hand and there is no enforcement on active forks, `CheckEipVersionsConfig.UNTIL_FORK = "Prague"` excludes Osaka and Amsterdam from the `spec_version_checker` entirely.
- The stored value is the EIP markdown **git blob SHA**, not a commit. While the EIP PR is still open, that blob is not on `ethereum/EIPs` master, so it cannot be verified against master and cannot be turned into a resolvable `https://github.com/ethereum/EIPs/blob//EIPS/eip-XXXX.md` link.

## Solution

Hard gate, all releases, no warn path, no devnet exception. A release cannot be cut until every referenced EIP PR is merged into ethereum/EIPs master. This is intentional as it makes each release self certifying (every pin resolves to a real master commit) and pushes back on cutting devnet releases ahead of the EIP process, rather than papering over it with PR head references.

Start in spec.py with REFERENCE_SPEC_VERSION, then trace CheckEipVersionsConfig.UNTIL_FORK and the spec_version_checker to understand which forks and releases are currently checked. Done means every release is hard-blocked until each referenced EIP PR is merged into ethereum/EIPs master, with no warning path or devnet exception.

Written by the indexing model from the issue text.