[Templates] Rewrite template.json as the commit-pinned compatibility bridge #1181

Summary

Every published @common-grants/cli from 0.1.0-alpha.2 through 0.4.0 fetches templates/template.json from main at runtime, and TypeSpec resolves the manifest's relative files[].path entries from the same branch. ADR 0029 (#1089) keeps that manifest on main for 90 days as a commit-pinned bridge so the root template projects can be removed.

Rewrite the manifest so every files[].path is an absolute raw GitHub URL containing the full commit SHA of the final monorepo snapshot (the last commit that still contains templates/quickstart, templates/express-js, and templates/fast-api). TypeSpec leaves absolute template URLs unchanged, so installed CLIs keep producing the same output while the directories disappear from main.

Protect the retained manifest: an automated integrity check that verifies the whole file against an approved digest (file sources, write destinations, dependency declarations, and generation settings), and review controls on the path. The repo has no CODEOWNERS today and already enforces the Protect main (PR review) ruleset, so the smallest change is a CODEOWNERS entry for templates/template.json with code-owner review required in that ruleset.

The archived content is unsupported during the bridge. It gets no dependency updates and no compatibility guarantee.

Acceptance criteria

• Every files[].path in templates/template.json is an absolute raw.githubusercontent.com URL containing the full snapshot commit SHA; no relative paths remain
• cg init --list and cg init --template <quickstart|express-js|fast-api> verified against representative published CLIs (at least one from each of the 0.1.x, 0.2.x, 0.3.x, and 0.4.0 lines, covering their bundled or runtime-resolved compiler) produce the same files as before the rewrite, with templates/*/ absent from the checkout
• A CI check fails when the manifest's digest differs from the approved digest
• Changes to templates/template.json require review (CODEOWNERS or ruleset)
• The pinned SHA, approved digest, and verification matrix are recorded on this issue