release: establish canonical product version

[ktjn]

Summary

• adds root VERSION as the canonical Observable product version
• adds a stdlib-only verifier for Rust workspace crates, frontend package metadata, and the primary Helm chart
• adds a dedicated required CI workflow that fails on version drift
• marks the first Milestone 7 roadmap item complete

Version contract

VERSION is the value release automation should read when naming tags, images, charts, SBOMs, provenance, and release notes.

The verifier currently checks:

• every Rust workspace member package.version
• apps/frontend/package.json
• charts/observable/Chart.yaml version
• charts/observable/Chart.yaml appVersion

Verification

python3 scripts/check-version-sync.py

This completes the roadmap item Establish one repository/product version source of truth and prepares the next item: immutable-tag artifact builds.

[ktjn]

Closing as a duplicate of #573, which is the retained implementation for the Milestone 7 version source-of-truth item.