feat: update snapshot revisions through CLI

[tisonkun]

Summary

• add a root-level config.toml with [snapshot.cpp], [snapshot.go], and [snapshot.java] sections containing each upstream repository and pinned commit
• add snapshots sync to regenerate all snapshot directories from config.toml without changing the config
• make snapshots update <language> <revision> resolve one branch, tag, or commit to an exact commit ID, update that source's config, and regenerate its snapshots
• keep snapshots check <language|all> as the read-only verification command
• report source revision changes in CLI output and update the maintenance documentation

Updates intentionally accept one source at a time instead of a list of language=revision pairs. This keeps partial-failure behavior and review scope straightforward; sync is the single command for applying all currently configured sources.

Repository URLs and commits are configuration data. Tool requirements, generator implementations, and snapshot stability rules remain in Go because changing them changes TCK behavior rather than selecting an upstream source.

No new behavior tests are added. The existing CLI help snapshot is updated for the new command surface.

Validation

• mise run check
• GOOS=windows GOARCH=amd64 go build ./...
• mise run tck -- snapshots check go (0 added, 0 deleted, stable contents unchanged; 41 allowed probabilistic modifications)
• manually verified snapshots sync --help, snapshots update --help, missing update revision, and rejection of update all main