Automate manifest.json version updates during release

Update `make release` to write the version into manifest.json and commit
it before tagging, so the packaged artifact always carries the correct
version. Also add a CI guard in the release workflow that fails early if
the tag and manifest versions ever diverge.

https://claude.ai/code/session_0158SxS2ATe6PL8zTpsoHRFn

.github/workflows/release.yml

@@ -16,6 +16,15 @@ jobs:
             - name: Check out code
               uses: actions/checkout@v5
 
+            - name: Verify manifest version matches tag
+              run: |
+                  TAG_VERSION="${GITHUB_REF_NAME#v}"
+                  MANIFEST_VERSION=$(grep -oP '"version"\s*:\s*"\K[^"]+' manifest.json)
+                  if [ "$TAG_VERSION" != "$MANIFEST_VERSION" ]; then
+                    echo "::error::Tag version ($TAG_VERSION) does not match manifest.json version ($MANIFEST_VERSION)"
+                    exit 1
+                  fi
+
             - name: Set up Go
               uses: actions/setup-go@v5
               with:

Makefile

@@ -19,6 +19,10 @@ release: test
 	@if [[ ! "${V}" =~ ^[0-9]+\.[0-9]+\.[0-9]+.*$$ ]]; then echo "Usage: make release V=X.X.X"; exit 1; fi
 	go mod tidy
 	@if [ -n "`git status -s`" ]; then echo "\n\nThere are pending changes. Please commit or stash first"; exit 1; fi
+	@# Update version in manifest.json
+	@sed -i 's/"version": *"[^"]*"/"version": "${V}"/' manifest.json
+	git add manifest.json
+	git commit -m "Release v${V}" --allow-empty --no-verify
 	git tag v${V}
-	git push origin v${V} --no-verify
+	git push origin main v${V} --no-verify
 .PHONY: release