build: adopt file-backed dynamic package version

[YAO-001]

What does this PR do?

• adds a root VERSION file as the committed package-version source of truth
• makes setuptools resolve project.version dynamically from that file
• updates the PyPI workflow to validate the tag-derived value as PEP 440 and write it to VERSION before building
• updates release documentation and CPU CI path filters
• adds a CPU-safe regression test that changes VERSION in a temporary source tree and checks setuptools metadata
• merges the latest main, preserving the PyPI FLA dependency and verbose Twine upload changes while advancing VERSION to 0.0.7

Related issue

Fixes #39

Type of change

• Bug fix
• New feature
• Breaking change (public API / CLI behavior changes in a non-backward-compatible way)
• Documentation update
• Refactoring
• Performance improvement
• Test coverage improvement

How was it tested?

• python -m pytest tests/test_package_metadata_cpu.py tests/test_setup_guardrails_cpu.py tests/test_engine_roles_cpu.py -q (8 passed)
• parsed both modified GitHub Actions workflows with PyYAML
• git diff --check upstream/main...HEAD
• ARENO_BUILD_EXT=0 python setup.py --version (0.0.7)
• before the upstream merge, built an isolated sdist and verified that it contained VERSION and matching PKG-INFO metadata
• python -m pytest tests/ -k cpu remains unavailable on this Windows checkout because collection reaches the existing POSIX-only termios import; Linux CI covers the full CPU suite
• pre-commit and ruff are not installed in the local environment, so I have not verified those locally

No GPU tests were needed because this change only affects package metadata and release automation.

Checklist

• The PR title summarizes the contribution.
• Linked the related issue in the description.
• Existing tests pass (pytest tests/ -k cpu) - blocked locally by the Windows/POSIX import noted above; CI should run this on Linux.
• New behavior is covered by tests.
• Described the test commands run and hardware limitations.
• Public API / CLI behavior is unchanged.

[YAO-001]

Hi @adohe, PR #471 is up to date with main and mergeable. The PR workflows are currently blocked with action_required, and no CI jobs were created. Could you please approve and run the workflows when convenient? Thanks!