Pin base-demo CI to Base v1.6.0

[codeforester]

Context

Base main has moved past v1.5.0 with Ubuntu/Debian apt-backed setup and dev-profile support. base-demo CI is intentionally pinned to a released Base tag, currently v1.5.0, so it should move only after Base v1.6.0 is cut.

This issue is the first slice of the Base 1.6 alignment train for base-demo.

Scope

• Wait until the basefoundry/base v1.6.0 tag exists.
• Update .github/workflows/tests.yml Base checkouts from v1.5.0 to v1.6.0.
• Update tests/validate.sh release-pin guard and error text to require v1.6.0.
• Keep CI pinned to the release tag, not Base main.
• Do not change the platform boundary wording in this issue except where required by the pin.

Validation

• ./tests/validate.sh
• git diff --check
• GitHub Actions validate and validate-ubuntu pass on the PR.

Dependencies

Blocked until Base v1.6.0 is tagged and available from basefoundry/base.

Follow-ups

The Ubuntu setup validation and platform-boundary documentation updates should happen in separate follow-up issues after this pin lands.

[codeforester]

Issue train created:

1. Pin base-demo CI to Base v1.6.0 #159 Pin CI to Base v1.6.0. Blocked until the Base tag exists.
2. Add Ubuntu apt-backed Base setup validation for v1.6 #160 Add Ubuntu apt-backed Base setup validation. Depends on Pin base-demo CI to Base v1.6.0 #159.
3. Update platform boundary docs for Base v1.6 Ubuntu setup #161 Update platform-boundary docs for Base 1.6. Depends on Pin base-demo CI to Base v1.6.0 #159 and Add Ubuntu apt-backed Base setup validation for v1.6 #160.
4. Refresh base-demo AI context for current representative environment #162 Refresh .ai-context for the current representative environment. Ready now.
5. Track future Base docker-service adoption in base-demo #163 Track future Base docker-service adoption. Blocked on Implement future docker-service artifact support when a real project needs it base#124.

Recommended PR order: #162 can land immediately; #159 -> #160 -> #161 should wait for Base v1.6.0; #163 remains a future tracker until Base lands the docker-service contract.