Release jobs previously accepted a branch dispatch or a tag that disagreed with package versions. A preflight job now requires refs/tags/v<version> and checks the root version against every public npm workspace, Zig's build.zig.zon, and its Pantry manifest before building or publishing.
Both publish paths depend explicitly on successful validation, including the npm path that otherwise continues after native build failure. Manual reruns remain supported when dispatched against the matching tag. Diagnostics report every mismatched manifest together.
Validation: four tests cover matching stable/prerelease tags, malformed versions, branch/missing/mismatched refs, all mismatch diagnostics, and public-workspace discovery; the current v0.0.92 metadata passes; Pickier and diff whitespace checks pass. CI runs the tests.
Closes #272.