chore(release): expose release train metadata

[krisarmstrong]

Summary

Adds releaseTrain to Stem runtime version metadata, derived automatically from buildTime as YYYY.MM. This keeps SemVer as the canonical version while exposing the calendar release train in the same /__version contract used by the product family.

Linked Issue

Fixes #445

Type of Change

• Defect fix
• Feature
• Chore / refactor / dependency update
• Documentation
• CI / release / packaging
• Security hardening

Risk

• Low
• Medium
• High

Testing Evidence

/opt/homebrew/bin/go test ./internal/version
ok  github.com/MustardSeedNetworks/stem/internal/version  0.306s

/opt/homebrew/bin/go test ./...
ok  github.com/MustardSeedNetworks/stem/...  (full suite passed)

git diff --check
<no output>

Security and Release Checklist

• No secrets, tokens, credentials, or customer data are included.
• Mutating routes, auth surfaces, permission checks, and output encoding were reviewed if touched.
• Dependencies are pinned and justified if changed.
• Documentation, screenshots, or operator notes were updated if behavior changed.

[github-actions]

License Compliance Report

All dependencies pass license compliance checks

Go Dependencies

• Unknown: 31 package(s)
• MIT: 26 package(s)
• BSD-3-Clause: 16 package(s)
• Apache-2.0: 11 package(s)
• BSD-2-Clause: 1 package(s)

npm Dependencies

See full report in workflow artifacts

Allowed Licenses: MIT, Apache-2.0, BSD-*, ISC, CC0-1.0, MPL-2.0
Forbidden: GPL, AGPL, SSPL (strong copyleft)

[github-actions]

License Compliance Report

All dependencies pass license compliance checks

Go Dependencies

• Unknown: 31 package(s)
• MIT: 26 package(s)
• BSD-3-Clause: 16 package(s)
• Apache-2.0: 11 package(s)
• BSD-2-Clause: 1 package(s)

npm Dependencies

See full report in workflow artifacts

Allowed Licenses: MIT, Apache-2.0, BSD-*, ISC, CC0-1.0, MPL-2.0
Forbidden: GPL, AGPL, SSPL (strong copyleft)

[github-actions]

License Compliance Report

All dependencies pass license compliance checks

Go Dependencies

• Unknown: 31 package(s)
• MIT: 26 package(s)
• BSD-3-Clause: 16 package(s)
• Apache-2.0: 11 package(s)
• BSD-2-Clause: 1 package(s)

npm Dependencies

See full report in workflow artifacts

Allowed Licenses: MIT, Apache-2.0, BSD-*, ISC, CC0-1.0, MPL-2.0
Forbidden: GPL, AGPL, SSPL (strong copyleft)