test: version-consistency drift guard — all version strings must match CHANGELOG

[DanielPodolsky]

Problem

A release currently touches 12+ version-string locations updated by hand (base-install.sh/.ps1, project-install.sh/.ps1 banners + manifests, core/templates/dashboard-data.js.template meta.version, DASHBOARD_CONTRACT.md example, .claude/commands/own/init.md ×4, README.md badge). The v2.6.0 bump did this via sed — it worked, but nothing prevents a future release from missing location #13. A missed spot ships silently (e.g. an installer banner claiming the old version).

Proposal

Add a check to the deterministic test suite (likely tests/commands.test.sh, same pattern as the command-documentation and pure-ASCII drift guards):

1. Extract the latest released version from CHANGELOG.md (first ## [x.y.z] heading)
2. Assert every known version-bearing file contains that version (and ideally, contains no other \d+\.\d+\.\d+ that looks like a stale OwnYourCode version)
3. A forgotten bump = red CI instead of a user bug report

Notes

• Stretch: introduce a single VERSION file as source of truth that scripts read at runtime — bigger refactor, the drift test gets ~90% of the value first
• Decide policy for tests/fixtures/sample-project.dashboard-data.js (2.5.0-dev) — it's sample data, probably exempt, but the test should make that exemption explicit

Origin: v2.6.0 release-process audit (PR #17).