- Site landing pill now reads version from workspace Cargo.toml via a
  Vite-injected build constant in astro.config.mjs. One source of truth
  for the displayed version.
- publish-crates CI job is now version-bump driven: runs on every push
  to main, checks crates.io for the workspace version, and publishes
  the four crates in dependency order if absent. Then tags v<version>,
  which triggers the existing release-version job for binaries.