feat: refuse placeholder versions in the schema

core_version is a string the code states, null or keyed by build mode,
and the schema refuses Git, SVN, unknown, master, main, latest, dev and
HEAD, alone or annotated. version_basis is defined per kind with the
fields each one needs, and kind none requires a null version.

tests/test_version_basis.py reads a recorded fixture of forge answers
offline and fails on drift, holds every profile to a basis (tag versions
in describe form, aliases equal to their profile, none as null), checks
that a pin advance reads the version again or is refused, and that the
schema refuses placeholders.

scripts/generate_site.py

@@ -7799,6 +7799,7 @@ _UNVERIFIED = {
     "host_unsupported": "its host cannot be read",
     "host_gone": "its source is gone",
     "host_unreachable": "its host did not answer",
+    "pin_off_branch": "its recorded revision is not the build described",
     "no_artifact": "no build recorded as read",
     "no_source": "no source declared",
 }