Bump the version before testing and building, not after

[marknolan]

main is red and the published v0.4.0 bundle reports 0.3.0. Both come
from the same ordering bug in cut-release.yml, which the v0.4.0 release
(dispatched an hour ago) was the first to exercise since v0.1.7.

What happened

The workflow ran the tests, then the build, and only then npm version. So the
artifact it published was built from the pre-bump tree:

• package.json → 0.4.0
• SDK_VERSION, baked into the bundle → still 0.3.0

SDK_VERSION is what a webBLEDemos page logs at startup to say which build it
is running — by the comment in src/version.ts, "a stale vendored copy is
otherwise indistinguishable from a firmware fault". The release made the bundle
lie about itself. It also left main failing, because src/version.ts never
moved:

FAIL  tests/core/version.test.ts > SDK_VERSION > matches package.json (bump both together)
  expected '0.3.0' to be '0.4.0'

That test exists to catch exactly this drift, and could not: it ran against the
tree as it was before the bump.

The fix

The bump comes first and carries src/version.ts with it — stamped from
package.json with sed, then verified with grep so a rename of the constant
fails the release loudly rather than silently shipping a stale string. Tests and
build then run against the version actually being released, and the commit and
tag are made afterwards from that tested tree (npm version --no-git-tag-version
plus an explicit commit and annotated tag, instead of letting npm version commit
before anything has been checked).

src/version.ts moves to 0.4.0 here — what main should have said since the
release — which makes the suite green again: 1889 pass.

What this does not fix

The published v0.4.0 artifact still self-reports 0.3.0 and cannot be
corrected in place. CHANGELOG.md says so under [0.4.1] and points at the
next release. Nothing should vendor v0.4.0; I have held the re-vendor of both
consoles until v0.4.1 exists, so no consumer ever carries the mislabelled
build.

After merging

Cut Release → patch → v0.4.1. That release then also proves the fixed
ordering: if the stamp fails, the run fails before publishing anything.

🤖 Generated with Claude Code

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}