ci: bootstrap pin -> 2026.7.30.2 (released, mirrored, indexed, install-verified)

Deliberately a separate commit, after the three preconditions actually hold. The
pin is the self-hosting STARTING point, not a release artifact — bumping it before
the index serves the version sends every CI job to install something that does not
exist.

All three verified before this commit:

  released   v2026.7.30.2, four platforms, release.yml overall success
  mirrored   xlings-res/mcpp on GitHub AND GitCode; full GETs byte-exact against
             upstream, both hosts cmp-identical, all four index sha256 values
             independently recomputed from the downloaded payloads
  indexed    openxlings/xim-pkgindex#455 merged (ebf4020c), latest -> 2026.7.30.2,
             and the artifact has propagated: a fresh clean-room XLINGS_HOME
             resolves and installs it

Install-verified end to end, never touching the developer's own ~/.xlings:

  xlings install mcpp@2026.7.30.2   → ✓ 1 package(s) installed
  mcpp --version                    → mcpp 2026.7.30.2
  cross-project cache hit           → Cached mcpplibs.cmdline v0.0.1 (3 units),
                                      0 compile edges for the dependency, binary runs

This is also the commit that makes ci-fresh-install meaningful again: while the pin
sat at 2026.7.29.2 that workflow was green about the PREVIOUS release and said
nothing about this one.

Author: Sunrisepeak

.github/workflows/ci-fresh-install.yml

@@ -40,7 +40,7 @@ concurrency:
 # fails with `version not found` instead of silently testing an older
 # binary. Bump together with the .xlings.json workspace pin at release.
 env:
-  MCPP_PIN: '2026.7.29.2'
+  MCPP_PIN: '2026.7.30.2'
 
 jobs:
   # ──────────────────────────────────────────────────────────────────

.xlings.json

@@ -1,5 +1,5 @@
 {
   "workspace": {
-    "mcpp": "2026.7.29.2"
+    "mcpp": "2026.7.30.2"
   }
 }