Function readToolVersion

env-cap's own installed version -- stamped onto EvidenceModel.provenance.toolVersion and mixed into computeSourceFingerprint(). ./build never reads its own manifest from disk (ADR 0040).