feat: enforce strict SemVer 2.0 and type Surge.NET versions

[peters]

Summary

• enforce strict Semantic Versioning 2.0 parsing, canonicalization, and precedence handling across Rust release, install, update, and FFI entry points
• vendor an MIT-licensed SemVer implementation into Surge.NET and switch managed app/release/version APIs to typed SemVersion values
• tighten release-index delta metadata and release scripting so emitted versions stay SemVer 2.0 compliant

Closes #81.

Behavior impact

• invalid versions such as 1, 1.2, 01.2.3, 1.2.3-01, and whitespace-padded values are now rejected instead of being accepted loosely
• release-index delta descriptors now require a valid from_version and the push path records the actual previous release baseline
• Surge.NET lifecycle callbacks and public app/release/version properties now use SemVersion rather than string

Source attribution

• vendored managed SemVer source is based on WalkerCodeRanger/semver tag v2.3.0
• upstream license is MIT and is included under dotnet/Surge.NET/Semver.LICENSE.txt

Validation

• ./scripts/sync-surge-core-vendor.sh --check
• ./scripts/check-version-sync.sh
• cargo fmt --all -- --check
• RUSTFLAGS="-D warnings" cargo test --workspace
• cargo clippy --all-targets --all-features -- -D warnings
• cargo clippy --workspace --lib --bins --examples -- -D warnings -D clippy::unwrap_used -D clippy::expect_used
• cargo clippy --workspace --all-targets --all-features -- -D warnings -W clippy::pedantic
• dotnet format dotnet/Surge.slnx --verify-no-changes
• dotnet test dotnet/Surge.slnx --configuration Release

Migration note

• downstream .NET callers that read or pass version values as strings need to update to SemVersion and call .ToString() only at string boundaries