fix: make release preparation validate the complete release contract

[chtnnh]

Problem

The release workflow accepts any v* tag without matching it to package metadata. The bump helper does not update every release surface, and the CLI version test is hard-coded to 0.3.0. A future tag can publish the wrong package version or make the release preparation fail after edits.

Scope

Create one authoritative release-version contract spanning manifests, lockfile, action/docs pins, tests, changelog, tag, and publish workflow.

Acceptance criteria

• Version tests derive from package metadata rather than a fixed literal.
• Release preparation updates all required version-bearing files, including the lockfile.
• Workflow fails before publish when tag, manifest, lockfile, and changelog disagree.
• Publish/release sequencing is retry-safe.
• A dry-run test validates the complete 0.4.0 preparation path.