fix(version): embed VERSION file so source builds show a real version

[LeanSheng]

Problem

gog --version returns the bare word dev when the binary was built via plain go build ./cmd/gog from a source checkout — the most common path for contributors and anyone trying the project locally.

Commit 6af52a4 was meant to fix exactly this for go install …@vX.Y.Z users by adding a runtime/debug.ReadBuildInfo() fallback. That fallback works for module-versioned installs, but Go reports Main.Version == "(devel)" for binaries built directly from the main module, and the new code explicitly skips that sentinel. So go build from a clone still prints dev.

The runtime is also fundamentally limited here: debug.BuildInfo.Settings embeds vcs.revision (commit SHA) but never the tag name. So something has to bake the tag in at build time.

Fix

Bake an internal/cmd/VERSION file (currently v0.17.0-dev) into the package via //go:embed, and consult it after BuildInfo in resolvedVersion(). The file lives next to version.go because //go:embed cannot escape the package directory.

To keep the file from rotting, add a post-release-bump workflow that runs on every v* tag push and rewrites internal/cmd/VERSION to <just-pushed-tag>-dev. So after you tag v0.18.0, CI commits v0.18.0-dev to main automatically. No human maintenance required after this PR.

Behavior after this lands

Install method	Output	Source
Released binary (goreleaser ldflags)	v0.17.0 (abc123 …)	ldflags — unchanged
make build	v0.17.0 / v0.17.0-N-gabc1234	Makefile ldflags — unchanged
go install …/cmd/gog@v0.17.0	v0.17.0	debug.BuildInfo.Main.Version — unchanged
go build ./cmd/gog from a fresh clone	v0.17.0-dev	embedded VERSION (new)
Any build with no git available (Makefile/Dockerfile fallback)	v0.17.0-dev	embedded VERSION (new)

Files changed

• internal/cmd/VERSION (new) — v0.17.0-dev
• internal/cmd/version.go — //go:embed VERSION, rename devVersion → sentinelDev, add embedded fallback in resolvedVersion()
• internal/cmd/version_test.go — two new tests covering the (devel) fallback and the empty-everything sentinel. All existing tests pass unmodified.
• .github/workflows/post-release-bump.yml (new) — auto-bumps VERSION to <tag>-dev on tag push, commits to main with [skip ci].
• CHANGELOG.md — note under ## 0.17.1 - Unreleased / Fixed.

Things for the maintainer to confirm

1. Branch protection on main: the workflow pushes directly to main using GITHUB_TOKEN. If main is protection-gated against direct pushes from Actions, the workflow will fail visibly on the next tag and we'd need to switch it to open a PR via gh pr create instead. I left it as direct push because it's the simpler model and a [skip ci] chore commit feels low-risk.
2. Bump policy: defaulting to <just-pushed-tag>-dev (e.g. after tagging v0.17.1, VERSION becomes v0.17.1-dev). Means VERSION always tracks the last released tag, with -dev marking the period afterward. If you prefer v0.17.2-dev (predicting next) instead, easy one-line workflow change.

Verification

# 1. The broken case
go build -o /tmp/gog ./cmd/gog
/tmp/gog --version
# => v0.17.0-dev   (was: dev)

# 2. Ldflags-injected build still wins
go build -ldflags "-X github.com/steipete/gogcli/internal/cmd.version=v0.17.0" -o /tmp/gog ./cmd/gog
/tmp/gog --version
# => v0.17.0

# 3. Tests
go test ./internal/cmd/...
# => ok (26s on my Mac)

🤖 Generated with Claude Code