fix(release): synchronize protected v2.28 runtime identity

CHANGELOG.d/2.28.0-release-identity.md

@@ -0,0 +1,4 @@
+## Fixed
+
+- Synchronized the LineageWeave runtime `__version__` with the Python and frontend package metadata at `2.28.0`.
+- Added `tests/test_package_version.py` so release identity drift fails before a protected release can be treated as reproducible provenance.

lineageweave/__init__.py

@@ -130,4 +130,4 @@
     "serialize_lineage_analysis_result",
 ]
 
-__version__ = "2.20.0"
+__version__ = "2.28.0"

tests/test_package_version.py

@@ -0,0 +1,20 @@
+"""Release identity stays consistent across Python and frontend artifacts."""
+
+from __future__ import annotations
+
+import json
+import tomllib
+from pathlib import Path
+
+from lineageweave import __version__
+
+
+def test_release_versions_are_synchronized() -> None:
+    """Runtime provenance must use the same version as shipped package metadata."""
+    repository_root = Path(__file__).resolve().parents[1]
+    project = tomllib.loads((repository_root / "pyproject.toml").read_text(encoding="utf-8"))
+    frontend = json.loads(
+        (repository_root / "frontend" / "package.json").read_text(encoding="utf-8")
+    )
+
+    assert __version__ == project["project"]["version"] == frontend["version"]