CDN consumers pin versions

CDN consumers must pin an explicit version rather than always fetching “latest.” Floating CDN URLs look convenient because they auto-update, but they make builds non-reproducible and can introduce unreviewed breaking or compromised content.