feat: add version subcommand and inject CLI version in container builds

[rokuosan]

Summary

• add a version subcommand to print the CLI version
• inject cmd/cli.Version at build time via -ldflags in the container build
• update the container image workflow to publish to GHCR only on tag builds

Details

• default the CLI version to dev and allow overriding it at build time
• add tests for the new version subcommand and root command wiring
• pass the version from the container build workflow into the Docker build as a build arg

Testing

• go test ./...