extdeps versioning program: UpstreamSpecCitation + RestApiVersionHeader + RestApiPathVersion

[gunbai-bot]

Summary

• Adds dsl/extdeps/version.dag — single authority for upstream version citation types per DESIGN.md §3 (UpstreamVersionLabel, UpstreamSpecCitation, RestApiVersionHeader, RestApiPathVersion)
• Migrates 4 extdeps consumers from bare String fields and inline comment citations to typed data declarations:
  • extdeps/cron/schedule_model.dag — posix_crontab_spec: UpstreamSpecCitation (replaces inline comment)
  • extdeps/llm/anthropic.dag — current_api_version: RestApiVersionHeader (dissolves the local AnthropicApiVersion type)
  • extdeps/github/github.dag — default_rest_api_version: RestApiVersionHeader
  • extdeps/cloud/gcp/gcp.dag — GcpApiEndpoint.version: RestApiPathVersion (grounds path segment "v1"/"v2" as typed carrier)
• Adds dsl/test/claim/extdeps_version_witness_test.dag with by-execution witnesses for all 4 consumers; discriminating — each goes RED if a field reverts to bare String

Test plan

• gunbc run --source-root dsl --entry dsl/test/claim/extdeps_version_witness_test.dag --function extdeps_version_witnesses --claim-run → true
• gunbc run --source-root dsl --entry dsl/test/claim/extdeps_round2_grounding_witness_test.dag --function extdeps_round2_grounding_witnesses --claim-run → true
• cargo fmt --all --check passes

🤖 Generated with Claude Code

[gunbai-bot]

Closing — superseded wrong abstraction (fidelity UpstreamSpecCitation carriers). Same rejection as #5301/#5310. Approved base is #5311 VersionIdentity/VersionScheme/VersionConstraint. Closeout session should not reopen this shape.