verifyLlvmToolMajor

Runs <tool> --version, parses the first line for an LLVM major- version number (e.g. clang version 18.1.8 → "18"), and throws if the parsed major differs from expectedMajor. The defence-in- depth complement to StigLlvmToolchain: even when every task uses the registry, a misconfigured PATH (clang++-18 symlink pointing at clang-22's binary, version-suffix-stripped install, etc.) can let the wrong major sneak in. This function catches that at task- configuration / pre-exec time, before the offending binary actually produces bitcode.

Defaults expectedMajor to StigLlvmToolchain.LLVM_MAJOR so most callers just pass the tool name.

Two parse strategies tried (in order):

1. clang version (\d+)\. — clang's preferred format.

2. LLVM version (\d+)\. — llvm-link / llvm-dis / opt / etc.

Throws on:

• tool not on PATH (via resolveExecutable).

• exec failure / non-zero exit.

• unparseable output.

• parsed major != expected.