fix(bootstrap): enforce manifest-pinned sources