v0.2.0

Refuse a mislabelling release before it publishes, not after

The check I added for a tag that names a different commit was in the job
that writes the tag, and that job runs after publish. So it would have
refused the release only once PyPI already held the files - the exact
failure it exists to prevent, half done, and unrepeatable because a version
cannot be uploaded twice. A gate after the irreversible step is not a gate.

It now runs in build, next to the check that the tag and pyproject agree,
which is where the question belongs: both ask whether this commit is
entitled to this version number, and both can still answer for free. The one
in the tagging job stays as the last word before the tag is written, in case
it moved while the run was in flight.

This is not theoretical. v0.2.0 is on the commit that fails and master is
now the commit that does not, so a dispatch aimed at publishing the fix was
one job away from uploading it and then declining to tag it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M7qqvypeowm2rM4EdJ4GBw