Pin zic so timezone-data generation is reproducible

Summary

Make timezone-data generation reproducible by pinning or hermetically supplying the zic compiler used by scripts/generate-timezone-data.js.

Why

An immutable IANA tzdata tarball should produce reviewable, byte-stable generated artifacts. Host zic drift currently changes the embedded binary even when the upstream tzdata version and zone count are identical.

Current behavior

The generator invokes the ambient host tool:

zic -b fat -d <output> <source files>

The monthly workflow installs the runner's current tzdata package but does not pin the zic implementation or record its version.

Regenerating the recorded source URL for tzdata2026c on macOS with zic (tzcode) 2022g produces:

• 598 zones
• 701,932-byte timezone blob

The committed artifact generated by Ubuntu CI from the same tzdata2026c URL contains:

• 598 zones
• 704,788-byte timezone blob

The resource hashes also differ. Repository history shows the monthly automation regenerated tzdata2026c twice (#971 and #1058) with different generated output despite the unchanged upstream version.

Relevant paths:

• scripts/generate-timezone-data.js
• .github/workflows/timezone-data-bump.yml
• source/generated/Generated.TimeZoneData.pas
• source/generated/Generated.TimeZoneData.res

Expected behavior

• Pin or hermetically supply a supported zic implementation/version for local and CI generation.
• Record the compiler identity in generation output or workflow logs.
• Add a reproducibility check showing that the same tzdata tarball and generator inputs produce byte-identical Pascal metadata and resource output.
• Keep the existing IANA version/source provenance intact.

Scope notes

Do not replace the committed resource with the locally generated macOS artifact as part of this issue. The goal is to define the canonical toolchain first, then regenerate deliberately.

Read scripts/generate-timezone-data.js and .github/workflows/timezone-data-bump.yml first, then inspect the committed files in source/generated/. Define the canonical zic source and how its identity is recorded, and add a reproducibility check showing byte-identical Pascal metadata and resource output from the same tzdata inputs while preserving the existing provenance.