fix: read __version__ from package metadata + bump to 0.1.0rc2

[smochan]

Summary

Caught during the v0.1.0rc1 TestPyPI smoke: `from codegraph import version`
returned `"0.0.1"` while the installed wheel was `0.1.0rc1`. The hardcoded
string in `codegraph/init.py` had drifted from pyproject — and would
have drifted again on every future bump.

Replaces the hardcoded literal with `importlib.metadata.version("polycodegraph")`,
so the in-Python attribute auto-syncs with pyproject.toml forever.

Changes

• `codegraph/init.py`: reads from `importlib.metadata`. Falls back
  to `"0.0.0+local"` only in the (unusual) case of a source checkout with
  no install — every `pip install` / `pip install -e .` path registers
  metadata.
• `tests/test_cli_smoke.py`: new `test_version_matches_package_metadata`
  locks the auto-sync in. If someone re-hardcodes the version, CI fails
  immediately with a clear message.
• `pyproject.toml`: version bumped to `0.1.0rc2` so we can re-validate
  the fix on TestPyPI before the v0.1.0 final tag.

Local verification

```
$ python -c "from codegraph import version; print(version)"
0.1.0rc2
$ ruff check codegraph tests
All checks passed!
$ pytest -q
596 passed in 9.69s
```

What's next after merge

1. Tag `v0.1.0rc2` → release workflow → TestPyPI dry-run fix(analysis): skip tests/fixtures + Protocol classes from dead-code/untested #2
2. Verify in fresh venv: `version` now shows `0.1.0rc2` correctly
3. If clean, bump to `0.1.0` (final), tag `v0.1.0` → real PyPI publish

[github-actions]

codegraph PR review

Diff vs main · severity ≤ high

codegraph review (target: main)

Diff: +1 / -0 / ~0 nodes, +5 / -0 edges

Findings (0)

No findings.

_{Triggered by codegraph CI · last run}