ci(release): derive release version from the tag, not the commit

The release job built whatever version package.json held at the tagged
commit — but main always carries a -develop suffix, so a vX.Y.Z bundle
would have reported X.Y.Z-develop. Make the tag the source of truth:
strip the suffix in the ephemeral CI checkout before building (never
committed), and fail fast when the tag base doesn't match package.json's
base (wrong-commit guard). Update CONTRIBUTING with the tag-driven flow.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -21,6 +21,24 @@ jobs:
 
       - run: npm ci
 
+      # The tag is the source of truth for a release version. main always carries
+      # a `-develop` pre-release suffix, so strip it here (in the ephemeral CI
+      # checkout only — never committed) so the built bundle reports the bare
+      # X.Y.Z. Guard against tagging the wrong commit: the tag's base must match
+      # package.json's base version.
+      - name: Align package.json version to the tag
+        env:
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          VERSION="${TAG_NAME#v}"
+          PKG_BASE="$(node -p 'require("./package.json").version.split("-")[0]')"
+          if [ "$VERSION" != "$PKG_BASE" ]; then
+            echo "Tag $TAG_NAME (base $VERSION) does not match package.json base ($PKG_BASE)." >&2
+            echo "Tag the commit whose package.json is ${VERSION}-develop." >&2
+            exit 1
+          fi
+          npm version "$VERSION" --no-git-tag-version --allow-same-version
+
       - run: npm run build
 
       - name: Locate bundled output