DX-2103: auto-derive release version (semver bump)

[lloyd-cio]

What

Structural follow-up item 6 from DX-2103: stop requiring a hand-typed release version.

• version input is now optional; blank = auto-bump the latest vX.Y.Z tag.
• new bump input (patch/minor/major, default patch) picks the level.
• an explicit version still works as an override.

How it works

Resolution happens once in the validate_dispatch job (resolve-version) and is plumbed downstream as a job output. The tag re-dispatch already carries an explicit version=<tag>, so the publish jobs (github_release, npm_publish, github_packages_publish) are unchanged and keep using inputs.version.

Changes

• release-version.js — add pure bumpVersion(base, level).
• release-workflow.js — add latestTag() + resolveVersion() and a resolve-version command; export both.
• release.yml — optional version + new bump input; validate_dispatch resolves and exposes outputs.version; tag_and_dispatch and the dry-run job consume that output.
• release-workflow.test.js — tests for bumpVersion (levels, v-prefix, bad inputs) and the resolveVersion override path.

Validation

• node .github/scripts/release-workflow.test.js passes.
• Live derivation against current tags (latest v0.0.11): patch→0.0.12, minor→0.1.0, major→1.0.0, VERSION_INPUT=v2.5.0→2.5.0.
• YAML parses.
• After merge: a dry-run dispatch with blank version derives + validates without publishing; first real blank-version release exercises tag creation end-to-end.

Safety

The explicit version override remains throughout, so this can't strand a release. Tag-exists / registry-version guards are unchanged (they run after resolution).