fix(release): pack the tarball after the CLI is rebuilt

[simoncodes-ca]

Fixes the aside reported on #86: lingo-tracker --version printed 0.16.0 on the published
0.17.0 package. Confirmed against the published tarball — package.json says 0.17.0,
dist/apps/cli/main.cjs says version("0.16.0").

Cause

The version is not hardcoded. apps/cli/src/main.ts uses .version(__CLI_VERSION__), and
apps/cli/esbuild.config.js replaces that token at build time from the root package.json.
The bundle therefore freezes whatever version was current when the CLI was built.

The workflow's Build step runs before pnpm run release, so the first CLI bundle carries
the previous version. semantic-release then runs its prepare steps in plugin order:

#	Plugin	What it does
1	@semantic-release/changelog	writes CHANGELOG.md
2	@semantic-release/npm	bumps package.json, then packs the tarball into dist/
3	@semantic-release/exec	pnpm nx build cli --skip-nx-cache — rebuilds with the right version
4	@semantic-release/git	commits

Step 3 fixes the bundle, but step 2 already packed the tarball, so npm publish ./dist/*.tgz ships the pre-bump build.

The republish job does not have the bug: it checks out the tag (already bumped), builds,
then packs.

Fix

Drop tarballDir from the npm plugin so it only bumps the version, and pack from the exec
step after the rebuild — the ordering republish already proves works.

["@semantic-release/npm", { "npmPublish": false }],
["@semantic-release/exec", {
  "prepareCmd": "pnpm nx build cli --skip-nx-cache && npm pack --pack-destination dist"
}]

Also adds a step that unpacks the tarball and fails the release if the packed CLI does not
report the version in package.json, so a regression here stops before npm rather than
after. Same spirit as the existing "Verify tag matches package version" step in republish.

Verified

Ran nx build cli --skip-nx-cache && npm pack --pack-destination dist locally and unpacked
the result:

version("0.17.0")   ← dist/apps/cli/main.cjs
"version": "0.17.0" ← package.json

The tarball lands as dist/simoncodes-ca-lingo-tracker-0.17.0.tgz, so the existing
dist/*.tgz glob and hashFiles guard still match. The verify step's shell was exercised
both ways: it passes on a matching tarball and its failure branch fires on a mismatched one.

One caveat: the fix can only fully prove itself on a real release run, since locally
package.json was already at the released version. The verify step exists to catch it if
the ordering is still wrong.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RifJr7xyhZkaTWn4ssV1b4

[lingo-tracker-release]

🎉 This PR is included in version 0.18.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀