ci: enforce typecheck and version sync

[WhatsYourWhy]

Why

Two gaps in an otherwise tight release pipeline:

1. Nothing typechecked. esbuild strips types without checking them, and npm test runs with TS_NODE_TRANSPILE_ONLY=1. No workflow ran tsc, so a type regression could ship.
2. Nothing validated the release tag. release.yml fires on tags: ["*"], and CLAUDE.md documents that the tag MUST equal manifest.json version because Obsidian's store matches them as plain strings — but that invariant was purely manual, as were the package.json parity and versions.json entry.

What changed

• npm run typecheck (tsc --noEmit over both tsconfigs), wired into CI and release.
• scripts/check-version-sync.mjs enforcing manifest/package parity, a versions.json entry matching minAppVersion, and — when given a tag — tag equality.
  • CI runs it without the tag arg, so a mis-bump fails at PR time instead of tag-push time.
  • release.yml runs it first, before npm ci; it is dependency-free, so a mistyped tag fails in seconds.
• CLAUDE.md updated — it described these as manual steps.

Pre-existing type errors this surfaced

Adding the gate turned it red, which was the point:

• 2× TS5097 — tests import with explicit .ts extensions for ts-node/ESM resolution. Fixed with allowImportingTsExtensions + noEmit in tsconfig.test.json.
• 1× TS2741 — NoteStats.lastOpened is declared required, but metrics.ts does stats.lastOpened ?? fallbackMtime ?? now and SPEC.md documents the mtime fallback. store.ts guarantees the field post-sanitization, so the production invariant is correct and the test was constructing an intentionally degraded record. Fixed in the test with a cast rather than making the field optional, which would have made store.ts's guarantee meaningless.

No release required

main.js, styles.css and manifest.json are byte-identical to the published 0.5.0 (main.js sha256 561dc75d…). Everything here is dev tooling; nothing ships to users, so no version bump.

Verification

• check:versions, lint, typecheck, build, test all pass locally
• Both workflow YAMLs parse; the version-check command was executed as extracted from release.yml, not retyped
• Guard proven on all five paths: passes on 0.5.0 and the no-tag CI form; fails on v0.5.0, package/manifest drift, missing versions.json entry, and minAppVersion mismatch
• Committed blobs verified LF

🤖 Generated with Claude Code