test: hard-pinned apache-arrow version in numeric-oracle test breaks every lockfile refresh #367

Evidence

test/architecture_numeric_oracle.test.ts:104 hard-pins the exact apache-arrow version:

expect(lockfile.packages['node_modules/apache-arrow']?.version).toBe('21.1.0');

Dependabot group bump #366 moved apache-arrow 21.1.0 → 21.2.0 in the lockfile and this assertion fails in all 8 test-matrix jobs (expected '21.2.0' to be '21.1.0', run 36407990264). Because the numeric oracle fixture is byte-level (0x10000 words), some version pin is intentional — but pinning to an exact patch version means every routine lockfile refresh turns the entire CI matrix red and blocks unrelated green bumps merged into the same group PR.

Proposal

• Pin to the minor/range actually validated against the oracle (e.g. assert startsWith('21.') or match a SUPPORTED_ARROW constant defined next to the fixture generation), and regenerate/verify the oracle whenever the supported range changes.
• Alternatively split the arrow pin into its own manually-bumped dependency so dependabot never touches it.

Either way the assertion should encode "compatible with the oracle fixture" rather than "exactly the version of today".

(Found by the automated daily sweep on 2026-09-29; no code changed.)