Fix release workflow version verification

[placerda]

Summary

• pin release package builds to the tag version before uv sync/build can dirty the checkout
• fail TestPyPI verification in the install step if the expected package never appears
• make Cut Release move Unreleased changelog notes under the version heading

Validation

• parsed release workflow YAML with ruamel.yaml
• simulated changelog release insertion

[placerda]

Validation passed on PR checks. Local validation covered YAML parsing for the touched workflows and changelog release insertion simulation.