fix(ci): read release version from Cargo.toml, not cargo metadata (ADR-0054)

The ADR-0054 version guard piped `nix develop -c cargo metadata` to node,
but the flake devShell prints a banner to stdout — corrupting the JSON
pipe, so the guard aborted under `set -e` and the v0.2.0 release failed
there (before building anything). Replace it with a toolchain-free
`grep -m1 '^version = ' Cargo.toml` (the anchor excludes dependency
`version =` keys). No real version mismatch occurred — the tagged commit
has version 0.2.0.

docs/adr/0054-release-versioning-and-version-surfaces.md

@@ -37,7 +37,9 @@ version I'm running" — that drift is a correctness problem.
    one rendered string and one version source.
 
 3. **Release-CI discipline.** `release.yaml`'s pre-build `test` job gains a
-   **version guard**: it parses `CARGO_PKG_VERSION` from `cargo metadata`
+   **version guard**: it reads the `[package]` version directly from
+   `Cargo.toml` (`grep -m1 '^version = '` — toolchain-free; an earlier
+   `cargo metadata | node` form broke on the flake devShell's stdout banner)
    and **fails the release** unless the pushed tag equals `v<that version>`.
    So `--version`, the release name, and the downloaded asset are always in
    lockstep — enforced by the machine, not by memory.