Wave-2 review findings on #7586:
- the guard accepted `17.2.8-rc.1`, and the publish step passes no
--tag, so a prerelease would have become the npm `latest` every
unqualified install and `omp update` resolve
- `v17.2.8` passed the guard and reached Cargo.toml verbatim, which
cargo rejects only after every manifest was rewritten; validation now
returns the normalized version and callers write that
Review findings on #7586:
- validate an explicit release version before comparing; the shared
comparator never throws, so 999.bad previously reached every manifest
- ci-release-notes imports the comparator by relative path: the
release_github job runs without bun install
- route Bun cache pruning through compareVersions and delete
compareSemverLikeVersions
- regression test for the release-version guard
can1357