`node -e` evaluates in a context where a top-level `return` is an outright
SyntaxError — unlike a CommonJS file, where it is legal and where this was
presumably written from memory. So the check threw "Illegal return
statement" on v0.4.2 instead of comparing anything.

It failed closed, which is the one piece of luck: the job stopped before
the publish step and nothing reached the registry.

Worth naming why this survived a rehearsal. The workflow_dispatch dry run
that was supposed to de-risk the release skips exactly this step — it is
`if: startsWith(github.ref, 'refs/tags/v')`, and a dispatch is not a tag.
A dry run can only exercise the branches a dry run takes; the tag-only
branch has no cheap rehearsal short of a tag.

Both directions verified locally this time: a matching tag prints agreement
and exits 0, a mismatched one lists every package and exits 1.