ci: require release tags to match package version

[rogerchappel]

Summary

• add an executable release-tag verifier that requires GITHUB_REF_NAME to equal v${package.json.version}
• run the guard before release tooling and artifact creation, with a static release-contract check for ordering
• cover matching, mismatching, and missing tags and document the maintainer contract

Commits

• test: cover release tag version verification
• feat: verify release tag against package version
• ci: guard release artifacts with tag verification
• docs: document release tag version contract

Verification

• npm ci
• npm run release:check (21 tests, typecheck, build, CLI smoke, package smoke, release contract)
• bash scripts/validate.sh
• git diff --check origin/main...HEAD

All commits are authored and committed by Roger Chappel miscanalysis@gmail.com.