ci: Commit version bumps before tagging and publishing

[krodak]

Overview

Commit the version bump before tagging so the repository and published package
have the same version. Start releases manually from main with a stable version
such as 1.5.0, rather than creating a GitHub release first.

1. Versioned source

Update both manifests, build and test, then commit as github-actions[bot].
Push main and its version tag atomically before publishing in the same workflow.

2. Release checks

Reject invalid versions, existing tags, and non-main dispatches. Serialize
releases without cancelling active runs. If npm publishing fails after the push,
publication from the existing tag is a separate recovery operation.

Test Plan

• npm ci
• npm test
• Exercise inline workflow scripts against isolated bare Git repositories: new
  release, existing tag rejection, invalid versions, unchanged version,
  non-main dispatch, and atomic push race.
• git diff --check

GitHub Actions execution and npm OIDC publishing remain untested.

[kateinoigakukun]

thanks!