ci: fail when release tag does not match package.json version

[Vombato]

Summary

• Replace silent npm version --allow-same-version overwrite with an explicit equality check.
• Fail the workflow if the GitHub Release tag (without leading v) does not match package.json version.

Test plan

• Create a release with a tag that does not match package.json — workflow must fail at the verify step.
• Create a release with a matching tag — workflow proceeds to publish.