Installation version pins

Pin an installation to the release it is running from Actions > Pin installation or with ryvn set version-pin, and optionally pin its configuration revision too. Release channel updates stop deploying while the pin holds, and a banner on the installation shows the pinned version and who pinned it. Unpin and the installation catches up to its channel's latest release.