ci(release): bump mcpb/manifest.json in lockstep + rebuild bundle

[5uck1ess]

Why

mcpb/manifest.json drifts behind .claude-plugin/plugin.json after every auto-bump. Two concrete problems:

1. Recurring CI breakage. manifest.json is hashed into devkit.mcpb.sources.json and zipped into devkit.mcpb. The next contributor who runs make sync-version locally (e.g. as a side effect of make build) bumps the manifest, which invalidates the sidecar and the bundle. The mcpb-bundle-integrity job in ci.yml then fails until someone rebuilds the bundle. PR chore: gitignore .antigravitycli/ and sync mcpb manifest to v2.1.32 #104 hit this exact trap.
2. Versioning lie. The published devkit.mcpb advertises e.g. 2.1.33 but ships a launcher that reads plugin.json and fetches the 2.1.34 engine. Runtime is fine (the launcher only uses plugin.json), but the bundle's advertised version is wrong.

What this changes

In release.yml Step 5 (bump job — only runs for auto-bumps):

• Add actions/setup-go@v5 (needed by bin/mcpb-build to cross-compile the launcher).
• Bump mcpb/manifest.json alongside .claude-plugin/plugin.json using jq.
• Run bin/mcpb-build to regenerate devkit.mcpb, devkit.mcpb.sources.json, and mcpb/server/devkit.exe.
• Stage all of those in the same bump to vX.Y.Z commit.

The launcher cross-compile is deterministic (-trimpath, -s -w, no embedded version), so mcpb/server/devkit.exe is usually byte-identical and git add skips it; only the bundle + sidecar actually change.

Also converts the bump job's shell steps to env: interpolation for inputs (defense in depth — these are repo-controlled, not event-controlled, but env: is cleaner and satisfies the workflow-edit security reminder).

Out of scope

• Manual-bump path. When a PR's merge commit already carries the bumped plugin.json (bumped == 'manual'), Step 5 is skipped entirely — this PR doesn't touch that branch. A follow-up could add a CI check that manual bumps also touch manifest.json + the bundle, but that's a separate concern.
• First-run drift catchup. This PR fixes drift going forward, but doesn't catch up the current 2.1.33→2.1.34 gap. The next auto-bump (whenever the next PR merges) will close it.

Test plan

Hard to dry-run a release workflow without an actual release. The verification is:

• YAML parses (ruby -ryaml -e \"YAML.load_file('.github/workflows/release.yml')\" → clean).
• All shell interpolations of needs.version.outputs.version moved to env: blocks.
• Bundle build script (bin/mcpb-build) already works on Linux (CI's mcpb-launcher-test job already exercises it on ubuntu-latest).
• Next PR merge after this lands: confirm the auto-bump commit on main includes all five files (plugin.json, manifest.json, devkit.mcpb, devkit.mcpb.sources.json, and possibly devkit.exe).
• Confirm mcpb-bundle-integrity stays green on the next several PRs after this lands (the symptom this is meant to prevent).