feat(config): make the canvas-generation/version pairing a gate, not a habit (T-1242)

project.yaml's version is the Atlas disk cache's only invalidation signal, and
nothing enforced that changing canvas GENERATION also moved it. It broke five
times -- 0.4.2 lake_margin_q, 0.4.3 coast_warp_px, 0.4.4 the extent inversion,
0.4.5 the Global sentinel, 0.4.6 one-course-per-river -- each bumped only after
someone noticed a wrong map. The failure is invisible to its author: it needs a
warm cache to reproduce, so a cold checkout looks fine. T-1239 is the last one,
and it took eight days.

tooling/canvas_sources.py is the path registry; tooling/check-canvas-version
rejects a push that touches those paths without moving project.yaml's version
line. Wired into the pre-push hook, `make check-canvas-version`, and, for the
parsing units, `make test-tooling`.

Verified against real history rather than a synthetic branch: run over
4e503c356 -- the commit that actually caused T-1239 -- the gate rejects and names
the three files. Run over the commits that DID bump (bdea71953, 39f0fd8c5, and
T-1239's own fix), it passes.

The registry is globbed, not hand-listed. step_canvas.rs imports ten sibling
modules and those import more, so a traced closure would be stale within a month,
and stale here is silent. It over-includes on purpose: a false positive costs one
bump and one round of cache misses, a false negative costs another week of a
wrong map -- the ticket's own ruling.

Two deliberate calls worth naming. The registry includes ITSELF, which closes the
narrowing hole: remove a path and change that same path in one push, and the gate
still fires because the registry file is in the set. And there is no override
flag -- it would be reached for exactly when someone is certain their change is
harmless, which is the reasoning behind all five regressions.

Version bumped 0.4.6 -> 0.4.7 with NO canvas-generation change: self-inclusion
means adding the registry trips its own rule. Spent rather than special-cased,
because the first exception is how a rule like this dies.

The units cover the property no branch run can show -- that editing project.yaml's
comment block, which quotes old version NUMBERS directly above the field, is not
a bump -- plus a registry-coverage test naming the files each of the five known
regressions touched, so a future narrowing past them fails loudly.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Makefile

@@ -3,7 +3,7 @@ GODOT := $(shell command -v godot4 2>/dev/null || command -v godot 2>/dev/null)
 .PHONY: help setup build client server game atlas stop test test-tooling lint lint-python setup-venv ci ci-client ci-server clean \
        decisions-sync decisions-active decisions-validate \
        validate-content check-fact-ids setup-hooks install-hooks \
-       audit deny atlas-verify economy-db regen-db check-systems-db check-client-version \
+       audit deny atlas-verify economy-db regen-db check-systems-db check-client-version check-canvas-version \
        pre-pr pre-pr-lint pre-pr-build pre-pr-test pre-pr-validate pre-pr-fixtures \
        pre-pr-server pre-pr-client pre-pr-content \
        fixtures-client fixtures-gauntlet golden-diff golden-update \
@@ -57,6 +57,7 @@ help:
 	@echo "  make regen-db          Regenerate systems.db from all sources + stamp meta table (#855)"
 	@echo "  make check-systems-db  Verify systems.db meta stamp matches current generator sources"
 	@echo "  make check-client-version  Verify client/project.godot version mirrors project.yaml"
+	@echo "  make check-canvas-version  Verify canvas-generation changes carry a version bump"
 	@echo "  make install-hooks     Install pre-push + pre-commit git hooks (once per clone)"
 	@echo "  make fixtures-client    Generate GDScript->Rust cross-encoder fixtures (#475)"
 	@echo "  make golden-diff        Show diff if golden file output has changed"
@@ -263,6 +264,10 @@ test-tooling:
 	@echo "  [test-tooling] oasis ring-scaling pin (T-964, PR #210 review)..."
 	@$(VENV_PY) tooling/planet-gen/test_oasis_ring_scaling.py 2> .cache/test-tooling-oasis-ring.log || \
 		{ echo "  FAIL: oasis ring scaling — log follows:"; cat .cache/test-tooling-oasis-ring.log; exit 1; }
+	@echo "  [test-tooling] canvas-generation version gate units (T-1242)..."
+	@mkdir -p .cache
+	@python3 tooling/test_canvas_version_check.py 2> .cache/test-tooling-canvas-version.log || \
+		{ echo "  FAIL: canvas version gate units — log follows:"; cat .cache/test-tooling-canvas-version.log; exit 1; }
 	@echo "  [test-tooling] economy_import.traits validation units (T-995/PR #173 H2)..."
 	@mkdir -p .cache
 	@python3 tooling/economy-db/test_traits.py 2> .cache/test-tooling-traits.log || \
@@ -410,6 +415,9 @@ check-systems-db:  ## Verify systems.db meta stamp matches current generator sou
 check-client-version:  ## Verify client/project.godot's baked version matches project.yaml (T-1241)
 	@python3 tooling/check-client-version
 
+check-canvas-version:  ## Verify canvas-generation changes carry a project.yaml version bump (T-1242)
+	@python3 tooling/check-canvas-version
+
 econ-sim:  ## Build the economics simulation binary (Layer 1+2: Leontief + tâtonnement trade)
 	@cargo build --manifest-path tooling/econ-sim/Cargo.toml --release
 	@echo "Built: tooling/econ-sim/target/release/econ-sim"