Automate manifest.json version updates during release

Update `make release` to write the version into manifest.json and commit
it before tagging, so the packaged artifact always carries the correct
version. Also add a CI guard in the release workflow that fails early if
the tag and manifest versions ever diverge.

https://claude.ai/code/session_0158SxS2ATe6PL8zTpsoHRFn

Makefile

@@ -19,6 +19,10 @@ release: test
 	@if [[ ! "${V}" =~ ^[0-9]+\.[0-9]+\.[0-9]+.*$$ ]]; then echo "Usage: make release V=X.X.X"; exit 1; fi
 	go mod tidy
 	@if [ -n "`git status -s`" ]; then echo "\n\nThere are pending changes. Please commit or stash first"; exit 1; fi
+	@# Update version in manifest.json
+	@sed -i 's/"version": *"[^"]*"/"version": "${V}"/' manifest.json
+	git add manifest.json
+	git commit -m "Release v${V}" --allow-empty --no-verify
 	git tag v${V}
-	git push origin v${V} --no-verify
+	git push origin main v${V} --no-verify
 .PHONY: release