chore(release): gate version drift and autobump server.json

[basicScandal]

Why

A Starlog release is two publishes — npm (package.json) and the MCP registry (server.json) — with the version hand-bumped in both. They drifted silently once (registry stuck at 0.1.9 while npm was 0.6.0) because nothing cross-checked the manifests. publish.yml verified the tag against package.json only, so server.json could ship stale.

What

• scripts/check-versions.mjs — CI gate asserting package.json and every server.json version field (top-level + each packages[]) share one pinned X.Y.Z. On a tag push it also asserts that shared version equals the tag. No deps (node builtins).
• ci.yml — runs the gate on every PR, before npm ci.
• publish.yml — runs the gate on tag pushes (fail-fast, before build/test), replacing the old package.json-only bash tag check so server.json can no longer ship stale.
• scripts/sync-server-version.mjs + npm version hook — npm version X.Y.Z auto-syncs server.json (surgical string replace, formatting preserved) and stages it, so the bump can't be forgotten. server.json is bumped 0.7.0 → 0.7.1 to match current package.json.

Verification

• npm run check:versions passes; mismatch and tag-mismatch paths exit 1 as intended.
• npm version patch end-to-end: the version hook fired, synced both server.json fields, and staged it into the version commit alongside package.json/package-lock.json (test bump reverted).

🤖 Generated with Claude Code