feat(release): unify product versioning

[SarthakWade]

Summary

• embed one validated product version in the CLI, both hosts, and the stdio MCP adapter while keeping protocol versioning independent
• add headless version / headless --version, include productVersion in host ping, and align package metadata with the latest tag
• propagate tag versions through macOS and Linux release builds, reject invalid or mismatched release tags, and generate release notes
• document the release/version contract and mark backlog item E6 complete

Security and correctness

• product versions are compile-time constants, not runtime environment values
• semantic-version validation prevents compiler-definition injection
• release jobs fail closed when a tag does not match the checked-in version
• Docker and native builds use the same fallback and override contract

Verification

• HEADLESS_VERSION=2.3.4-beta.1 pnpm test (44/44 protocol tests and MCP integration)
• pnpm test:runtime
• pnpm --filter @headless/web lint
• pnpm --filter @headless/web build
• Prettier check on changed JSON/YAML files
• pnpm test:e2e:linux
• pnpm test:e2e:mac
• macOS CLI and Info.plist version assertions
• custom-version Docker build and runtime assertion

Closes #44