ci(release): fail when the tag and package.json version disagree

[myselfsiddharth]

Summary

Pre-flighting the first npm release turned up a gap in .github/workflows/release.yml (added in #174, never yet run): nothing checks that the pushed tag matches the version in package.json.

The tag decides when to publish; package.json decides what gets published. Tagging v0.2.0 on a tree that still says 0.1.0 would publish 0.1.0 under a tag claiming 0.2.0 — or fail at the registry as "already published", after the token had already been used. This adds a step that fails before the registry call, while it is still free to fix.

Why this comes up now

There is already a stale v0.1.0 tag on main from 2026-08-09 (commit 90f66c6, far behind current HEAD). It predates release.yml, so it never triggered a run. Whoever cuts the first real release therefore has to either retag or bump — exactly the case this guard protects.

Test plan

• Guard passes when tag matches: v0.1.0 + package.json 0.1.0 → publishing 0.1.0 from tag v0.1.0
• Guard refuses on mismatch: v0.2.0 + package.json 0.1.0 → exits 1 with both versions named
• Verified the existing forbidden-path guard has no false positives — \.env is an unanchored regex, but no file in the 179-file tarball contains env at all
• npm pack --dry-run ships dist/src/, contracts/, README.md, LICENSE; dist/src/cli.js has its #!/usr/bin/env node shebang
• Repo is public, so --provenance will work; id-token: write is already set