[EdwardChamberlain]

Summary

• Package app_version.json with the Windows/macOS setup tools, wheel, source distribution, and USB CLI/GUI bootstrap.
• Record that metadata when a fresh USB install migrates into an OTA slot; keep legacy for installations where version data is absent or invalid.
• Keep the OTA slot file set and stable bootloader contract unchanged; OTA continues to report the bundle version.
• Make CI reject a candidate if the USB metadata version and release-validation.json candidate version differ.

Validation: 91 focused packaging, GUI, USB, OTA, and release tests passed (GUI imports used a lightweight shim because FreeSimpleGUI is unavailable locally). A v1.0.0 OTA artifact passed device validation. py_compile and git diff --check pass. python -m build could not run locally because the build package is not installed; CI builds and smoke-tests wheel/sdist.

Closes #49

[EdwardChamberlain]

Review of 44e2e797cdf980d224d5e77fe8b2d588aa6c83bd: no blocking findings.

The migration reads version metadata from the same source directory as the application it stages, including the bootstrap path; slot/debug/update status then reports that manifest version. Missing, malformed, non-string, or blank metadata retains the genuine legacy fallback. USB CLI/GUI, wheel, sdist, and desktop build resource lists include the metadata, and CI checks it against the candidate version.

The metadata remains outside OTA APP_FILES, preserving the existing nine-file slot/bootloader contract. I verified a generated bundle is accepted by the main branch's validator and that invalid metadata still migrates as legacy.

Verification: 64 packaging, GUI, USB, OTA, and version tests passed locally with a FreeSimpleGUI import shim; current CI is green, including desktop and distribution builds. Physical board tests were not repeated.