ci: stop committing the version bump back to main

[priosshrsth]

Run 32136394717 failed pushing chore: release v3.0.0 to main. Three rules rejected it at once:

- Changes must be made through a pull request.
- Code scanning is waiting for results from CodeQL.
- Commits must have verified signatures.

The commit was unsigned because a runner's git commit is always unsigned — GITHUB_TOKEN authenticates the push, it does not sign — and GitHub only auto-signs commits made through its API or web UI. Signing alone would not have helped: pull_request, required_linear_history, code_scanning, code_quality and copilot_code_review are all on main, and neither ruleset has a bypass actor. CI cannot write to that branch.

So it no longer tries. The version from the release tag is applied to package.json and src/version.ts in the runner only; the published artifact carries the right version and nothing is committed back. Permissions drop to contents: read.

What to look at:

• .claude/CLAUDE.md — the tradeoff this accepts: version in package.json on main is now a placeholder that lags npm. tests/version.test.ts keeps it consistent with src/version.ts, but reflecting the real published version means bumping both in a normal PR.
• If you would rather main stay accurate, the alternative is adding the GitHub Actions app as a bypass actor on both rulesets — that reopens direct bot writes to main, which is why I did not do it unasked.

Verified: bun run test (196 pass), vp check clean, workflow YAML parses. Re-running the failed v3.0.0 job after merge is the real test.

🤖 Generated with Claude Code

[priosshrsth]

Superseded by the release-please approach.