bug(release): derive CLI version from package metadata and validate release consistency

[Hebilicious]

Problem

At revision 94bf4d8177d01a293a2114573851c5000ebbcd7a:

• package.json declares version 0.4.0.
• cli.ts hard-codes the command metadata version to 0.1.0.

The CLI therefore does not use the package's version source. This makes version reporting and bug reports misleading and will persist across subsequent releases unless manually updated.

Proposed fix

Use one canonical release version and derive the CLI metadata from it, either through generated metadata or an appropriate build-time/source-compatible mechanism. Reuse the existing Changesets/version-sync workflow rather than introducing a competing manual version.

As part of the npm-primary publishing work in #22, add consistency checks for the package manifest, secondary JSR metadata, CLI metadata, and the intended release/changelog entry. Audit existing registry history before selecting the next version; do not overwrite or try to republish an already published version just to make numbers match.

Acceptance criteria

• Remove the independently hard-coded CLI version.
• An installed npm package's CLI reports the same version as that installed artifact.
• The secondary JSR/source-distributed CLI uses corresponding release metadata as well.
• Release checks reject inconsistent package/JSR/CLI metadata and validate the matching changelog entry according to the chosen release policy.
• An automated test builds or packs two fixture versions, demonstrating that the CLI metadata follows the release version without editing cli.ts.
• Tests run against the packed artifact, not only a workspace import.

This issue concerns version correctness. Publishing-channel selection and executable packaging remain in #22.