fix(ci): reject unsupported release tags in version check - #969

Problem

The version check requires pinned X.Y.Z manifest versions and is run for v* release tags. Its tag comparison currently runs only when the tag is already a pinned version, so unsupported tags such as v4.10.0-beta or v-next exit successfully against the stable 4.10.0 package.

Reject an unsupported tag with the existing pinned-version predicate instead of skipping the comparison. This is one conditional change; the matching release and mismatched pinned-release behavior stays intact.

Verification

• Before: the actual checker returns success for both unsupported tag examples, while matching v4.10.0 succeeds and mismatched v0.0.0 fails.
• After: one native subprocess test exercises the real checker with those four tag contexts; matching succeeds and all three mismatches fail.
• Full npm test: root 96, Pi 23, MCP 3 tests passed, no skips.
• Rule-copy check and all eight declared-version checks passed. git diff --check passed.

Local checks used Node 24 with a private HOME and denied outbound network. No package publication or real release was performed; hosted CI still requires maintainer approval.

This differs from #831's workflow dependency gate: it fixes the checker result itself, so it remains necessary when that workflow begins waiting for the checker.