Sync module.json from git tag in release workflow (fixes endless update loop)

[charlesvestal]

Summary

The v0.2.3 release shipped a tarball whose bundled module.json reports 0.2.2, so Schwung's Module Store advertises v0.2.3 (from release.json), downloads the tarball, finds module.json claims 0.2.2, decides the install is still on 0.2.2, and re-offers v0.2.3 on every sync — endless update loop.

Root cause

The repo has two module.json files:

• module.json (root) — the one the build copies into the tarball (cp /repo/module.json /repo/dist/dissolver/)
• src/module.json — the one the workflow's Verify version match step compares against the tag

At the v0.2.3 tag, src/module.json says 0.2.3 so the check passed. But root module.json was never bumped (still 0.2.2), and that's what got packaged. The two files have drifted before too — at present src/module.json is 0.2.3 and root module.json is 0.2.2.

(Aside: there's also a files/module.json reporting 1.0.0. Looks unrelated/stale — not touched in this PR.)

What this PR does

1. module.json (root): one-time bump 0.2.2 → 0.2.3 so master matches src/ and the latest tag.
2. .github/workflows/release.yml:
   • Replaced Verify version match with Sync module.json version from tag. Derives VERSION from the git tag and writes it into both module.json and src/module.json before the Docker build. The tag becomes the single source of truth.
   • The Commit release.json step now also writes the same version into both module.json files on the default branch and commits them alongside release.json, so the tree stays consistent with what was tagged.

After this, the author can cut a release with just git tag v0.x.y && git push --tags — no need to remember to bump module.json beforehand.

Caveat — v0.2.3 release asset

The existing v0.2.3 tarball asset still has module.json 0.2.2 inside. Users will keep seeing the update loop on v0.2.3 until either:

• a v0.2.4 is cut with this workflow change (recommended), or
• the v0.2.3 asset is re-uploaded from a rebuild.

Context

Reported by a user attempting to update Dissolver via the Module Store. Three sister bugs hit other community modules this week (bbgen / mestela/schwung-breakbeat, davebox / legsmechanical/schwung-davebox, euclidrum / filliformes/euclidrum-move) — PRs sent to all four.

Test plan

• Cut any test tag (v0.2.3-test1) on this branch and verify:
  • The "Sync module.json version from tag" step writes both files correctly
  • The built tarball contains module.json reporting the tag version
  • release.json on master ends up advertising the tag's version
  • module.json + src/module.json on master both end up at the tag's version