Release guard: fail when a stable workspace package's source changes without a version bump #120

Class of defect that shipped as the A10/protocol gap (#119): @deltic/protocol is published at a STABLE version (deliberately not prerelease-stamped — it is the cross-copy vocabulary package), and deno publish in the release workflow skips already-published versions. So a commit that changes protocol/src without bumping protocol/deno.json's version publishes prereleases whose ^<version> dependency resolves to STALE immutable content — a hard module-load failure for every consumer of that prerelease, undetectable by any in-repo gate (the workspace resolves protocol by path, so all tests see the new source).

Guard sketch (release workflow or publish-check): for each stable-versioned workspace package P (today: protocol), if P's version already exists on JSR, fetch the published content hash / file list and diff against the working tree's publish set (deno publish --dry-run knows the file set); any difference fails the job with 'bump P's version'. A cheaper git-only approximation: fail if git log <last-commit-touching-P/deno.json-version>..HEAD -- P/src is nonempty while the version at HEAD is already published.

Found by all six polymorph consumer-migration tracks on 2026-08-12; fixed for the instance by #119, this issue is the recurrence guard.