fix: fail the release run when the tag does not match the workspace version

[MaximeGaudin]

Summary

• release.yml built and published whatever tag it was pointed at without ever checking it against the crate version, so a mistyped or stale tag would ship a release whose assets do not match Cargo.toml.
• Added a verify-tag job (checkout the tag, compare ${TAG#v} to the [workspace.package] version in the root Cargo.toml, fail with an explicit error otherwise) and made build depend on it, so a mismatch fails before any build matrix leg starts.

Both the matching and mismatching cases were exercised locally against the real Cargo.toml.

Fixes #197

Test plan

• Workflow file parses as valid YAML; comparison logic verified locally for both outcomes (CI-only change, no code touched).
• CI green on the PR