fix(release): synchronize 1.2.3 versions and reject mismatched tags

[254808127]

Problem

The published v1.2.2 tag includes #31, but Cargo and both Skill bootstrap defaults remained 1.2.1. Release filenames alone therefore advertised a version the executable did not report, and new Skill installs selected the previous binary.

Changes

• Prepare 1.2.3 consistently in Cargo.toml, the root Cargo.lock package, and both bootstrap defaults. Keep already-published v1.2.2 tags/assets/checksums unchanged.
• Add a source-only PowerShell version gate: exact release tag, package/lock versions, Windows and macOS bootstrap defaults must agree. All three release builds depend on it, before signing/uploading.
• Check each compiled binary's --version before packaging (and before macOS signing).
• Add 19 dependency-free regression cases to Windows PowerShell 5.1 CI, including the exact 1.2.2/1.2.1 mismatch, stale lock/bootstrap defaults, missing/duplicate declarations, CRLF, prereleases, and standalone script invocation.
• Document the release sequence and v1.2.2 version mismatch; remove an outdated version pin in the command reference.

Validation / self-review

• 19 gate regressions passed under Windows PowerShell 5.1 and PowerShell 7.
• The actual published commit 6931e7f is rejected when checked with tag v1.2.2.
• All three workflow comparison fragments accept the locally built 1.2.3 binary and reject a 1.2.2 tag. This is a shell-gate test, not a claim of local macOS/Linux execution.
• Rust: 54 default tests passed; 2 opt-in real headless-browser tests passed.
• cargo fmt --check, cargo clippy --all-targets --locked -- -D warnings, shell syntax, workflow YAML/dependency-order checks and git diff --check passed.
• Local binary reports 1.2.3 via both --version and structured version.
• Reviewed scope, failure/skip propagation, tag injection boundaries, signing/upload order and preservation of existing release artifacts. No blocking findings remain.

The public v1.2.2 release notes now warn about the mismatch. After this PR is merged and CI passes, publish a new v1.2.3 tag on the merged commit, verify GitHub/COS downloads and Skill pins, then link the replacement from v1.2.2. Do not rebuild/overwrite v1.2.2. Full WorkBuddy product regression is separate and will use the corrected release.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T03:04:40.379148Z	bf98af4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bf98af4b83

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Run the version check on a matching macOS architecture

In build-macos, the macos-14 hosted runner is Intel/x86_64, while this command attempts to execute the newly built aarch64-apple-darwin binary. Every matching tagged release will therefore fail here with an incompatible-architecture error before signing, packaging, and publishing; use an ARM runner or verify the embedded version without executing the cross-compiled binary.

Useful? React with 👍 / 👎.