feat: add version-header verification tooling

[mmilanez]

Problem

Framework files carry human-readable version headers. Patch releases can leave those headers inconsistent unless release tooling verifies them.

Proposed change

Add a script and CI check that verifies expected Lead Protocol version headers across the maintained framework files.

Acceptance criteria

• A version check command exists and can run locally and in CI.
• The check has an explicit allowlist of files and avoids rewriting historical notes or changelogs.
• Release documentation explains what the header version means.
• Tests cover stale-header detection.

[mmilanez]

Partial pre-work landed in #12 (release 2.0.2 — README documentation overhaul).

The documentation acceptance criterion of this issue ("Release documentation explains what the header version means") is now addressed: the README "Checking which version you have" section explains that PROTOCOL_RULES.md records the kernel version (a floor, not the release number) — e.g. release 2.0.1/2.0.2 ships kernel 2.0.0 — and that the installed release is the top entry of CHANGELOG.md.

The remaining scope stays here under milestone v2.1.0:

• Version-check command (local + CI)
• Explicit allowlist of framework files
• Stale-header detection tests

This issue is not closed by #12 — only the doc criterion was advanced.