ci: verify release tag against crate version instead of overwriting

.github/workflows/release.yml

@@ -1,13 +1,27 @@
 name: Release
 
 # Conforms to the umbrella SDK release pipeline contract:
-# u5c-factory reference/sdk-pipeline-requirements.md
+# u5c-factory reference/sdk-pipeline.md
 on:
   push:
     tags: ['v*']
 
 jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Verify tag matches crate version
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          MANIFEST=$(sed -nE 's/^version = "(.+)"/\1/p' Cargo.toml | head -1)
+          if [ "$TAG" != "$MANIFEST" ]; then
+            echo "::error::tag $GITHUB_REF_NAME does not match Cargo.toml version $MANIFEST"
+            exit 1
+          fi
+
   build:
+    needs: verify
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -32,12 +46,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
-
-      - name: Set crate version from tag
-        run: sed -i -E 's/^version = .*/version = "'"${GITHUB_REF_NAME#v}"'"/' Cargo.toml
-
       - name: Publish to crates.io
         env:
-          # --allow-dirty: the version edit above leaves Cargo.toml modified in-tree.
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-        run: cargo publish -p utxorpc --allow-dirty
+        run: cargo publish -p utxorpc