ci: fail release if source version doesn't match tag

Author: boutetnico

.github/workflows/publish.yml

@@ -13,7 +13,21 @@ permissions:
   id-token: write
 
 jobs:
+  verify-version:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Check source version matches tag
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          SOURCE=$(jq -r .version package.json)
+          if [ "$TAG" != "$SOURCE" ]; then
+            echo "::error::Tag v$TAG does not match source version $SOURCE — bump package.json first"
+            exit 1
+          fi
+
   test:
+    needs: verify-version
     name: Test (Node ${{ matrix.node-version }})
     runs-on: ubuntu-latest
     strategy: