A release used to need VERSION raised by hand. Now every push to main that changes more than
docs is a release, and a new `version` job chooses the number once for all the builds:
- VERSION above every v* tag (raised by hand): that number, as before (the Latest release,
  or a pre-release when its CHANGELOG heading ends in "(nightly)"; its section is required).
- otherwise an automatic nightly: the next patch number after the newest tag, always a
  pre-release and never the Latest, with GitHub's list of the merged pull requests as notes.
The jobs write the chosen number into their own checkout's VERSION (nothing is committed), so
build.ps1, make package and build-macos.sh need no change. A run started again for a commit
that already has a tag releases nothing more, and a run on main waits for the one before it
instead of cancelling it (it may be publishing).

Checked: actionlint; the version step's script run against a local remote in nine cases
(hand bump, automatic bump, re-run, 5.0.9 -> 5.0.10 -> 5.0.11, no tags, pull request, matching
and mismatched tag); the Windows step under PowerShell 7. Not run on GitHub before the merge.

Co-authored-by: Kiro Agent <244629292+kiro-agent@users.noreply.github.com>
Co-authored-by: James Gabriele <178603515+4regab@users.noreply.github.com>