[MG_Remote, MG_Test, ci] (P7): sha256(protocol.fbs) is pinned to MOBILEGL_PROTOCOL_CONTROL_REVISION, so a control-schema edit without a bump is red in the unit lane and in flatc-check instead of a silently absent field

- the revision is a hand-bumped integer mixed into wireFingerprint and nothing tied it to protocol.fbs's content; scripts/ci/protocol_revision_pin.py holds {revision -> sha256(protocol.fbs)} in protocol_revision_pins.json and refuses a schema whose digest is not the current revision's, or a revision with no row
- registered as ProtocolSchema.RevisionPinsDigest (label unit, MG_Test/Wire/CMakeLists.txt, --self-test proves both perturbations red before it says green) and as a step of CI's flatc-check job, the one that regenerates the header on every schema edit
- --write records a bump's row and refuses to re-pin an existing revision to a different digest, which is what a schema edit without a bump looks like
- mg_protocol_base.h says where the pin lives beside the revision it pins
- red-once: protocol.fbs touched with one trailing comment, revision left at 1 -> "protocol.fbs has sha256 a7b5c7fb... but MOBILEGL_PROTOCOL_CONTROL_REVISION is still 1, which is pinned to 7fc859f7..." rc=1; restored, green

.github/workflows/test.yml

@@ -2217,6 +2217,16 @@ jobs:
       - name: Fail if the committed header is stale
         run: git diff --exit-code -- MobileGL/MG_Remote/Protocol/generated/protocol_generated.h
 
+      # P7 wave 2-F, F fix round (PH-7 (4) review). MOBILEGL_PROTOCOL_CONTROL_REVISION is mixed
+      # into wireFingerprint so a control-schema change refuses an old peer by name - but it is a
+      # hand-bumped integer, and nothing tied it to protocol.fbs's content. This step pins
+      # sha256(protocol.fbs) to the revision (scripts/ci/protocol_revision_pins.json): a schema
+      # edit that forgot the bump is red HERE, in the job that regenerates the header on every
+      # such edit, and not a silently absent field between an old server and a new client. Its
+      # self-test proves the check goes red on both perturbations before it says green.
+      - name: Fail if protocol.fbs changed without a MOBILEGL_PROTOCOL_CONTROL_REVISION bump
+        run: python3 scripts/ci/protocol_revision_pin.py --self-test
+
   # P0.5 interface-purity gate A (ARCHITECTURE.md:501): the two extracted headers' include closure,
   # asserted on `-H` output because `nm --undefined-only` is blind to "included but not called" -
   # a header whose types are never named leaves no symbol behind, and "included at all" is exactly