feat: let the release pick its own version

Preflight computes the release version instead of requiring a manual bump:
a patch bump past the highest of the latest v* tag and the npm-published
version, or cli/package.json's version when a PR raised it higher (minor/
major bumps). The version threads into publish-cli as a workflow input and
is applied with npm version before publishing. Basing the bump on npm as
well as tags means a rerun after a half-finished release always advances
past the orphaned npm version, so a tag can never point at code the
published tarball does not contain.