feat(release): one-command version bump via prepare-release.sh; close version-drift gaps

- scripts/release/prepare-release.sh bumps workspace + crate pins + npm
  wrapper + README install tags, refreshes Cargo.lock, regenerates the
  TUI changelog slice and web facts, then runs check-versions.sh
- check-versions.sh now also gates web/lib/facts.generated.ts and the
  README install-tag examples (both drifted silently before)
- .cnb.yml validates the pushed tag against Cargo.toml before generating
  mirror release notes
- RELEASE_CHECKLIST/RUNBOOK updated accordingly (v0.8.56 needed 9 fix
  commits for exactly these sync points)

docs/RELEASE_CHECKLIST.md

@@ -38,14 +38,15 @@ not enumerate.
 
 ## 2. Version pins are in sync
 
-- [ ] `Cargo.toml` workspace `version` is bumped.
-- [ ] All per-crate `crates/*/Cargo.toml` path-dependency `version = "..."`
-      pins match the new workspace version.
-- [ ] `npm/codewhale/package.json` `version` AND `codewhaleBinaryVersion`
-      are both bumped.
+- [ ] Run `./scripts/release/prepare-release.sh X.Y.Z` — it bumps the
+      workspace version, every per-crate dependency pin,
+      `npm/codewhale/package.json` (`version` + `codewhaleBinaryVersion`),
+      the README install-tag examples, refreshes `Cargo.lock`, regenerates
+      `crates/tui/CHANGELOG.md` and `web/lib/facts.generated.ts`, and ends
+      by running `check-versions.sh`. Write the CHANGELOG entry **before**
+      running it.
 - [ ] `npm/deepseek-tui/package.json` remains private/compatibility-only and
       is **not** bumped or published.
-- [ ] `Cargo.lock` is refreshed (`cargo update --workspace --offline`).
 - [ ] `./scripts/release/check-versions.sh` reports
       `Version state OK: workspace=X.Y.Z, npm=X.Y.Z, lockfile in sync.`
 - [ ] `./scripts/release/check-ohos-deps.sh` reports that the OpenHarmony

docs/RELEASE_RUNBOOK.md

@@ -113,9 +113,12 @@ Crate publishing to crates.io is **manual** — there is no automated
 `scripts/release/` from a developer workstation that has `cargo login`
 configured.
 
-1. Update the workspace version in [Cargo.toml](../Cargo.toml).
-2. Run `./scripts/release/check-versions.sh` and
-   `./scripts/release/publish-crates.sh dry-run` locally; both must be clean.
+1. Write the CHANGELOG entry, then run
+   `./scripts/release/prepare-release.sh X.Y.Z` — it bumps every
+   version-bearing file (workspace + crate pins + npm wrapper + README
+   install tags), refreshes the lockfile and generated files, and runs
+   `check-versions.sh`.
+2. Run `./scripts/release/publish-crates.sh dry-run` locally; it must be clean.
 3. Tag the release as `vX.Y.Z` (typically by pushing the version bump to
    `main` and letting `auto-tag.yml` create the tag — see the npm wrapper
    release section below for the `RELEASE_TAG_PAT` requirement).