Update `make release` to write the version into manifest.json and commit
it before tagging, so the packaged artifact always carries the correct
version. Also add a CI guard in the release workflow that fails early if
the tag and manifest versions ever diverge.
https://claude.ai/code/session_0158SxS2ATe6PL8zTpsoHRFn