v0.3.3: Derive release version from the tag instead of pushing to main (#40)

The one-click Release workflow pushed the npm-version bump commit
straight to main, which branch protection rejects (PRs + signed commits
+ status checks required). Drop that approach.

Instead, make Publish read the version from the release tag (v0.3.3 ->
0.3.3), write it into package.json in CI only, then build and publish.
Nothing is committed to main, so it works with branch protection and the
tag can never disagree with the published version. Removes the old
tag/version match guard (now unnecessary) and the release.yml workflow.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>