publish/binaries.py + rust/publish.py read the committed VERSION file, which
is stale in CI now stamping is central — the GH release shipped on the wrong
tag (v1.0.13 not v1.0.16) once set-version.py was removed. Extract
common.resolve_release_version (HYPERCI_VERSION -> VERSION -> None), the same
precedence container already used (#27); container/binaries/rust-publish now
share ONE resolver instead of three that drifted. _release-tail sets
HYPERCI_VERSION on the publish step.

Publish: true