ci: automate version bumps with scripts/release.sh + tag/version guard

[Lolle2000la]

Summary

Releases are tag-driven, but the version bump commit and the signed tag were both hand-made — which is how Cargo.toml drifted to 3.0.0-alpha.13 while the newest tag was v3.0.0-alpha.17. The binary reports the manifest version (About dialog, updater prerelease detection), so that drift is user-visible.

This adds a single local entry point for cutting a release and a CI guard that makes drift impossible to ship.

scripts/release.sh

scripts/release.sh 3.0.0-alpha.18 -F notes.md   # or -m "message"
scripts/release.sh 3.0.0-alpha.19 --dry-run     # validate only, change nothing

• Preflight: valid new version, clean tree, not behind upstream, tag unused locally and on origin, optional green-CI check for HEAD (gh+jq when present; --require-ci makes failures fatal).
• Bump: rewrites [workspace.package].version, refreshes Cargo.lock (cargo update --workspace, verified with cargo metadata --locked), commits chore: bump version to X.
• Tag: creates the signed annotated tag with your message (commit.gpgsign/tag.gpgsign), so the prefacing release summary still works exactly as when tagging by hand.
• Push: pushes the branch and tag; the tag push triggers release.yml unchanged.
• Any failure before the commit rolls Cargo.toml/Cargo.lock back. Flags: --no-push, --no-verify, --dry-run, -h.

The tag stays local/signed by the maintainer (no signing key in CI secrets), which is why the bump+commit+tag all happen in one local command rather than split across CI.

release.yml guard

New verify-version job (a dependency of deploy) that fails the whole run unless the tag name (minus v) matches both Cargo.toml's [workspace.package].version and Cargo.lock's media-sort-gui entry — before anything is built or signed.

Docs

Adds a ## Releasing section to AGENTS.md documenting the tag→build→sign→publish flow, the two version consumers, and the script.

Verification

• bash -n + shellcheck clean; --help, and the guard paths (missing/invalid/current version, existing local tag) all fail as intended.
• --dry-run against v3.0 leaves the tree untouched.
• The bump was exercised for real (3.0.0-alpha.13 → 3.0.0-alpha.18): cargo update --workspace updated the workspace members, cargo metadata --locked passed, and Cargo.lock reported the new version (then restored).
• The verify-version logic was run locally for a matching and a mismatching tag.
• release.yml parses as valid YAML.