ci: validate every member with mcpp 2026.9.28.1; latest_mcpp -> 2026.9.28.1

[speak-agent]

Moves the validation pin (.github/workflows/validate.yml, MCPP_VERSION) from 2026.9.26.2 to 2026.9.28.1, and index.toml's latest_mcpp from 2026.9.26.1 to 2026.9.28.1. min_mcpp does not move: the release changes no descriptor grammar.

2026.9.28.1 (mcpp-community/mcpp#727) changes four things a member's build can see:

• the lib root of a host-module package is ordered among its own package's units by what it imports;
• a workspace root with its own [package] passes its workspace tables to a member it reaches through a path dependency;
• two packages may deploy byte-identical files to one name;
• on Windows, a program built on an LLVM row uses the dynamic CRT, with the toolset's redistributable placed beside it. This is the model the cl row already used, and also the CRT of vcpkg's default x64-windows triplet and of CMake's default.

No descriptor here spells a CRT flag (a hand-written one that contradicts the model is now refused). No descriptor therefore needs a change; this pull request's full sweep is the measurement of that statement on every member and platform.

The comment blocks above the two lines record the same, in the form the earlier moves used.