feat: read core_version from its recorded basis

version_basis says where a profile's version is read: a pattern in a
file, the nearest tag and its distance, an alias, a package, none, or
unverified with the reason. profile_sync --verify-version reads it again
at the pin and exits 1 on a difference, --set-version writes what the
code states. A pin advance reads the version at the new pin in the same
write and is refused when it cannot.

upstream.describe counts the commits after the nearest tag in a treeless
clone kept under the cache, and graph_ancestry answers a pair GitHub
refuses to compare.

tests/test_profile_sync.py

@@ -60,9 +60,29 @@ from profile_sync import (
     worst_status,
 )
 import upstream
+import version_basis
 from upstream import CompareResult, FileChange
 
 
+def _version_read_as_written(profile, cache_dir, offline, profiles=None, recompute=False):
+    """bump_commit reads core_version again at the new pin. These fixtures
+    have no forge behind them, so the version reads as written here:
+    tests/test_version_basis.py holds the reading and the refusals."""
+    stated = version_basis.declared(profile, "")
+    return [version_basis.Reading("", "file", stated, stated, "fixture", version_basis.MATCH)]
+
+
+_VERSION_AS_WRITTEN = mock.patch.object(version_basis, "check", _version_read_as_written)
+
+
+def setUpModule():
+    _VERSION_AS_WRITTEN.start()
+
+
+def tearDownModule():
+    _VERSION_AS_WRITTEN.stop()
+
+
 class TestParseSourceRef(unittest.TestCase):
     def test_path_with_single_line(self):
         self.assertEqual(