Pin base-demo CI to Base v1.6.1

[codeforester]

Summary

• pin both Base checkouts in CI to v1.6.1
• update both base-bash-libs checkouts to the SHA used by Base v1.6.1 CI
• add a pre-execution manifest command review and basectl trust allow step before CI runs trusted project commands
• refresh current docs that still described the runtime platform contract as Base v1.5.0-specific

Root Cause

Base v1.6.1 introduced manifest-command trust enforcement for run, test, build, demo, and activate. base-demo was still pinned to Base v1.5.0, so CI did not exercise the current release behavior and would fail if moved forward without explicitly allowing the source-controlled manifest.

Closes #159.

Validation

• ./tests/validate.sh
• git diff --check
• isolated trust smoke:
  • basectl run base-demo --workspace /private/tmp/base-demo-159-workspace --list
  • basectl build base-demo --workspace /private/tmp/base-demo-159-workspace --list
  • basectl test base-demo --workspace /private/tmp/base-demo-159-workspace --dry-run
  • basectl trust allow base-demo --workspace /private/tmp/base-demo-159-workspace
  • basectl run base-demo --workspace /private/tmp/base-demo-159-workspace hello