Automate manifest.json version updates during release

Update `make release` to write the version into manifest.json and commit
it before tagging, so the packaged artifact always carries the correct
version. Also add a CI guard in the release workflow that fails early if
the tag and manifest versions ever diverge.

https://claude.ai/code/session_0158SxS2ATe6PL8zTpsoHRFn

.github/workflows/release.yml

@@ -16,6 +16,15 @@ jobs:
             - name: Check out code
               uses: actions/checkout@v5
 
+            - name: Verify manifest version matches tag
+              run: |
+                  TAG_VERSION="${GITHUB_REF_NAME#v}"
+                  MANIFEST_VERSION=$(grep -oP '"version"\s*:\s*"\K[^"]+' manifest.json)
+                  if [ "$TAG_VERSION" != "$MANIFEST_VERSION" ]; then
+                    echo "::error::Tag version ($TAG_VERSION) does not match manifest.json version ($MANIFEST_VERSION)"
+                    exit 1
+                  fi
+
             - name: Set up Go
               uses: actions/setup-go@v5
               with: