[P3][ci] Verify release tag matches package.json version before publish

[cevheri]

Summary

publish.yml does not verify that GitHub Release tag matches package.json version before publishing — mismatched release could ship wrong semver.

Audit ID: Section 4 Low — Wave 3
Location: .github/workflows/publish.yml:141 area

Fix

Add step before publish:

TAG="${GITHUB_REF_NAME#v}"
PKG="$(node -p 'require("./package.json").version')"
test "$TAG" = "$PKG" || { echo "Tag $TAG != package.json $PKG"; exit 1; }

Handle v prefix convention consistently with existing releases.

Acceptance criteria

• Mismatch fails workflow loudly.
• No changeset.

[cevheri]

Implemented and shipped in PR #43 (merge commit 69f7161), released as v0.2.0. The PR description's comma-separated Closes list only auto-closed the first reference — closing manually. For #39/#28-style partials: the shipped scope is done; the real-browser verification half of #39 continues under #10, and the typed-error contract (#28) shipped as LibreDbError with stable codes across kernel, adapters, lenses, and CLI.