feat(verifier): refuse a bundle built against a different action encoding

ActionWireContract names the encoding wireAction decodes and must equal the one
the bundled runtime entry declares. An absent declaration is a mismatch, not a
default: it is the package that shipped the zero-distance scroll. A bundle that
installs no picker generates no actions and is exempt.

internal/verifier/marshal.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"slices"
+	"strconv"
 	"strings"
 	"time"
 
@@ -594,6 +595,44 @@ func jsonToJSValue(runtime *goja.Runtime, raw json.RawMessage) (goja.Value, erro
 	return runtime.ToValue(generic), nil
 }
 
+// ActionWireContract names the encoding wireAction below reads, and must equal
+// the ACTION_WIRE_CONTRACT the bundled runtime entry declares. It is versioned
+// apart from @sanderling/spec because the encoding and the package move
+// independently: what this binary needs to know is which reading of the fields
+// it is being handed, not which release shipped it.
+//
+// The two halves can disagree without either failing. Revision 1
+// (@sanderling/spec 0.0.3 and earlier, which declares nothing) sent an authored
+// Scroll's container point as both endpoints; this binary reads pre-computed
+// endpoints as authoritative, so every such scroll dispatched successfully as a
+// 250ms press and hold and travelled zero distance, and no run said so.
+const ActionWireContract = "action-wire/2"
+
+// actionEncodingGlobal is where the bundled runtime entry declares its
+// contract (defineLockedGlobal in pkg/spec/src/runtime-entry.ts).
+const actionEncodingGlobal = "__sanderlingActionEncoding__"
+
+// ActionEncodingError reports a bundle whose declared contract is not the one
+// this binary decodes. declared is empty for a package published before the
+// declaration existed, which is the pairing that has to fail loudest: it is the
+// one that already produced a campaign of zero-distance scrolls.
+func ActionEncodingError(declared string) error {
+	built := strconv.Quote(declared)
+	if declared == "" {
+		built = "an @sanderling/spec that declares none at all (every release before " +
+			strconv.Quote(ActionWireContract) + ")"
+	}
+	return fmt.Errorf(
+		"action encoding mismatch: this specification was bundled against %s and this "+
+			"binary implements %q. Every action would still dispatch successfully while "+
+			"executing a different gesture, so the run stops here instead of producing "+
+			"wrong data. The @sanderling/spec the spec is bundled against and this binary "+
+			"must come from the same commit or a compatible release: re-install "+
+			"@sanderling/spec, or point the spec at the pkg/spec checkout this binary was "+
+			"built from",
+		built, ActionWireContract)
+}
+
 // wireAction is the unified flat wire contract both runtime entries emit
 // (runtime-entry.ts serializeAction). ONE decoder reads it on both the goja
 // (native) and the runner (web) sides, so a field rename cannot silently turn