`spm add --version <ver>` / `spm update --version <ver>` already wrote an
`artifactsVersionOverride` into the `.spm-injected.json` marker, and
`readArtifactsVersionOverride` already existed to read it back — but nothing
ever called it. Only the write half was wired; every reference to the reader
was a test.

The sole resolver, determineVersion, went straight from the `--version` flag to
node_modules/react-native/package.json. So after `spm add --version X`, a later
flagless `spm update` silently re-pointed the project at package.json's version
instead, while the marker went on claiming X. `--version` was effectively
single-use. In this monorepo package.json is 1000.0.0, which has no published
artifacts, so a flagless run after a pinned add fails outright — hence the
standing advice to pass `--version` on every invocation.

Insert the pin between the two existing sources:

    --version  ->  pinned override  ->  react-native/package.json

`spm download` and the scaffold path pick it up for free, since both use the
same resolved value. Since this is persistent state, log one line when the pin
is the source, so a stale pin is diagnosable rather than silent; there is still
no way to clear it short of `deinit`.

Three comments claimed the build-time sync read this override via
readArtifactsVersionOverride. It does not, and never did — the sync action
returns before artifacts are resolved at all. They now name the real consumer.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

## Summary:

The SwiftPM docs still described `--version` as "RN version (default: from
package.json)", which stopped being true once determineVersion started reading
the `artifactsVersionOverride` pin back out of `.spm-injected.json`. Document
the real resolution order and why it matters:

- The `--version` row in "CLI Options" now names all three sources in order —
  the flag, the pin a previous `--version` wrote into the marker, then
  node_modules/react-native/package.json — and says you pass it once.
- A new "Pinning the React Native version" subsection explains the failure the
  pin prevents, which is not self-evident: the resolved version selects which
  artifact slots the project is wired to, so a flagless run falling back to
  package.json re-points the project at different slots while the marker still
  advertises the pinned one. It also states that `deinit` drops the marker and
  with it the pin, so a later `add` resolves package.json again unless you pass
  `--version`.
- The `.spm-injected.json` row in "What to commit" described the marker only as
  a record of the edits `add` made. One appended sentence makes its second role
  visible; the row is otherwise untouched, since sibling PRs edit it too.

No advice to repeat `--version` on every invocation existed in the docs to
correct — that workaround was only ever passed on verbally.

The file is not Prettier-formatted on this branch, so it was deliberately not
reformatted: prose stays wrapped near 80 columns and table rows stay on one
line, matching the surrounding style.

## Changelog:

[Internal] - Document the `spm --version` pin and its resolution order

## Test Plan:

Docs-only change; no code or tests touched. Verified against the branch's own
diff that the marker key is `artifactsVersionOverride` (read by
`readArtifactsVersionOverride` in scripts/spm/generate-spm-xcodeproj.js) and
that `determineVersion` in scripts/setup-apple-spm.js resolves flag → pin →
node_modules/react-native/package.json.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>