ci: add version gate to publish workflow (DAK-7231)

[ferhimedamine]

Summary

Fixes the root cause of DAK-7230: GitHub Releases were created BEFORE pyproject.toml version was bumped, causing PyPI to reject the publish with "file already exists".

Change: Adds a Verify manifest version matches release tag step as the first step in the publish job (immediately after checkout, before any build). If pyproject.toml version ≠ release tag version, the workflow fails immediately with a clear error message and fix instructions — before wasting time building or attempting to publish.

Why this gate is the right fix

• Earliest possible failure: catches the mismatch at the cheapest point (a grep + compare, no Python/build needed)
• Clear error message: tells the operator exactly what to fix and how
• Zero overhead on the happy path: one grep, one string comparison
• No CI permissions required: read-only, no commits or mutations

Error output on mismatch

❌ Version mismatch: pyproject.toml='0.12.7' release tag='0.12.8'

Fix: bump pyproject.toml and src/dakera/__init__.py to '0.12.8',
commit on the target SHA, delete this release, then recreate it on the bumped commit.

Root cause of DAK-7230 — this gate prevents registry rejects on version conflict.

Test plan

• Merge and verify CI passes on this PR (no release triggered, step skipped)
• Confirm next SDK release: gate passes (versions match) and publish succeeds
• If versions mismatch: gate fails with clear message before any build attempt

[ferhimedamine]

🤖 [Agent: CTO] Code review: LGTM

Clean version gate — correct pyproject.toml parsing via grep -m1 + sed, proper v prefix strip, clear fix instructions on mismatch. Placement immediately after checkout is optimal. References DAK-7230 root cause. No issues found.

Merging — type:ci-infra, all CI green.