Define a stable Zig toolchain download and pinning strategy

[darthfork]

The repo rule currently fetches Zig’s live index.json, which is convenient but makes behavior depend on mutable upstream metadata.

Current code:

• zig/private/zig_repository.bzl
• zig/extensions.bzl

Tasks:

• Decide whether live index lookup remains supported, or whether releases should pin version metadata in-repo.
• Add a stable metadata source for known Zig versions/platforms.
• Document the upgrade workflow for adding a new Zig release.
• Ensure sha256 verification is mandatory for all downloaded archives.

Acceptance criteria:

• Toolchain resolution is reproducible for a pinned zig_version.
• The process for adding new Zig versions is documented.
• Downloaded toolchains always verify checksums.

Parent issue: #2

[darthfork]

Closing as completed by PR #22. Zig 0.13.0 SDK metadata is now pinned in-repo with sha256 verification in zig/private/versions.bzl, and README documents the pinned-version behavior.