build: single-source the version in a VERSION file

[nmatt0]

Summary

Make a top-level VERSION file the single source of truth for the version.

Why

The version was duplicated across CMakeLists.txt (project(VERSION ...)),
package.nix (the Nix flake), and debian/changelog, with nothing keeping
them in sync. A release bump could update one and miss another, shipping a
mislabeled artifact.

What

• VERSION (new, repo root) holds the number once (0.2.1).
• CMakeLists.txt reads it with file(STRINGS) and passes it to
  project(), so MITHRIL_VERSION still flows from PROJECT_VERSION.
• package.nix reads the same file with lib.fileContents.
• .github/workflows/release.yml gains a Version consistency step. CMake
  and Nix derive from VERSION and cannot drift; debian/changelog and the
  git tag carry the number independently, so the release fails if either
  disagrees with VERSION rather than publishing a mislabeled build.

debian/changelog is intentionally not derived: dpkg needs a literal, and the
file carries its own -N Debian revision plus changelog history. The CI guard
keeps it honest instead.

Release flow after this

Edit VERSION, add a debian/changelog stanza, tag v<VERSION>.

Testing

• Verified the version flows end to end: temporarily setting VERSION to a
  different value makes mithril --version report it; restored to 0.2.1.
• The Version consistency parse extracts the upstream version from
  debian/changelog and matches VERSION.
• Full unit + integration suite green.