Cut v0.3.38: every version declaration moves together #2718

Master now carries work that v0.3.37 — the latest published release — does not, so the next release needs its version declarations moved before a tag can name it.

Four commits have landed since that tag: the ios-app template placement fix, the failed-run explanation in scripts/read-run-failure.py, the test that pins the refusal to explain a run whose conclusion is not yet set, and self-media as a ninth built-in task type. None of them is in any published artifact.

What must hold for this to be finished:

• every version declaration in the tree names 0.3.38, and scripts/bump-version.py --check exits 0 on it
• tests/test_version_sync.py proves those declarations agree rather than assuming they do
• the tag v0.3.38 is cut after the merge, by a later run, and only once master's Test run on the merge commit has concluded green

The tag is deliberately not part of this issue. build-release.yml fires on the tag and on nothing else, so a tag pushed onto a tree whose CI has not concluded ships a signed release nobody has verified — and a published tag cannot be taken back.