fix: derive CLI version from package manifest

[rogerchappel]

Summary

• add failing-first regression coverage for a fixture manifest version
• derive scriptaudit --version from the package manifest at runtime
• verify packed/installed CLI and manifest versions agree
• document the single-source release contract

Commits

• 1a59b8e test: require manifest-derived CLI versions
• bd817dd fix: read CLI version from package manifest
• 2fd2a65 docs: define single-source version verification

Verification

• npm ci --ignore-scripts --no-audit --no-fund
• failing-first npm run build && node --test tests/version.test.mjs (fixture expected 9.8.7, CLI returned stale 0.1.0)
• npm run release:check (45/45 tests, typecheck, build, smoke, package smoke, release workflow check)
• disposable archive: npm version patch --no-git-tag-version then npm run release:check; built CLI and manifest both reported 0.1.1
• git diff --check origin/main...HEAD

Open PRs #8 and #9 only update GitHub Actions and do not overlap. All commit authors and committers are Roger Chappel miscanalysis@gmail.com.

[rogerchappel]

Automated merge note

Triage class: auto-merge

Summary: Derives the CLI version from the package manifest, adds built and packed-install regression coverage, and documents the single-source release behavior (3 files, +50/-1).

Checks run: GitHub CI Repository hygiene — COMPLETED/SUCCESS; worker verification recorded npm ci --ignore-scripts --no-audit --no-fund, failing-first focused coverage, npm run release:check (45/45 tests, typecheck, build, smoke, package smoke, release workflow check), a disposable npm version patch --no-git-tag-version full release check, and git diff --check. Full live diff, mergeability, branch protection, Roger Chappel author/committer identities, and head SHA re-verified immediately before merge.

Rebased/CI-repaired: no.

Verified head SHA: 2fd2a658dbd213e3d3ff751e38087174937c8753.